How to Recover Access After Losing Your Authenticator
Why a lost phone should not mean a lost account
Phones are lost, stolen, broken and replaced. When the authenticator app goes with them, the user cannot produce a sign-in code, and a business that relies on that person's access can stall.
Weak recovery is also a security hole. If anyone can call the help desk and ask for MFA to be removed, an attacker can do the same. Recovery has to be easy for the real user and hard for everyone else.
Biznsbook gives three routes, in order: one-time backup codes, an emailed recovery link, and an administrator reset that is audited and announced to the user by email.
Why this happens
- backup codes were never saved
- the backup codes were kept only on the lost phone
- MFA is reset without checking who is asking
- nobody knows who can reset MFA for a user
- the user does not set MFA up again after recovering
Biznsbook addresses this through backup code sign-in, emailed recovery link, administrator Reset MFA, account lockout after repeated wrong codes, available to every user without an extra licence.
Most account takeovers start with a reused or phished password. A second step on the user's own phone stops them.
Step-by-step: Recover Access After Losing Your Authenticator
Written for owners, administrators and every user who signs in to Biznsbook.
- Start signing in. Enter your email and password as usual.
- Choose the backup code option. On Two-step verification click Lost your phone? Use a backup code.
- Enter a backup code. Type one unused backup code; dashes and capitals do not matter. Click Verify and sign in. That code is now used up.
- Open the recovery email. Biznsbook emails a Biznsbook MFA recovery link. Click it to turn MFA off for your account.
- Set MFA up again. Go to My account, click Set up MFA and set it up on your new phone. You get a new set of backup codes.
- No codes left? Ask an administrator. A company administrator opens Management, Manage users, finds you, and uses More actions, Reset MFA after confirming who you are.
Review results after the first full monthly cycle. Adjust roles, mappings, or approvals where the same exception repeats.
Screen names in this guide match Biznsbook: My account, Set up MFA, Manage MFA, Two-step verification, Use a backup code, Session Security and Manage users.
Common mistakes to avoid
- Mistake 1: Backup codes were never saved Repeating this each month usually shows up first in a hijacked account or a locked-out user.
- Mistake 2: The backup codes were kept only on the lost phone Repeating this each month usually shows up first in a hijacked account or a locked-out user.
- Mistake 3: MFA is reset without checking who is asking Repeating this each month usually shows up first in a hijacked account or a locked-out user.
- Mistake 4: Nobody knows who can reset MFA for a user Repeating this each month usually shows up first in a hijacked account or a locked-out user.
- Mistake 5: The user does not set MFA up again after recovering Repeating this each month usually shows up first in a hijacked account or a locked-out user.
Each of these leaves an account open to anyone who learns the password, or locks out the real user when a phone is lost. Fix them before you need them.
Best practices that hold up as you scale
- Start signing in — Enter your email and password as usual.
- Choose the backup code option — On Two-step verification click Lost your phone? Use a backup code.
- Enter a backup code — Type one unused backup code; dashes and capitals do not matter.
- Open the recovery email — Biznsbook emails a Biznsbook MFA recovery link.
- Set MFA up again — Go to My account, click Set up MFA and set it up on your new phone.
Turn MFA on for administrators first, keep backup codes away from the phone, and agree a recovery routine before anyone needs it.
How Biznsbook supports this workflow
backup code sign-in is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.
emailed recovery link is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.
administrator Reset MFA is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.
account lockout after repeated wrong codes is part of Biznsbook sign-in security for every user on every plan, with each sign-in, failure and change recorded in the security audit log.
MFA uses an authenticator app; SMS and email codes, security keys and passkeys are not supported for sign-in. Customer, owner and supplier portals use their own sign-in.
Suggested implementation timeline
- Day 1: Administrators and finance users turn on MFA from My account and save their backup codes.
- Week 1: Ask the rest of the team to turn it on, and agree who may reset MFA for a user.
- Week 2: Require MFA for administrator roles on the Session Security page.
- Ongoing: Review MFA events in the security audit log and remind users to keep backup codes current.
Signing in with a backup code
Backup codes are the eight one-time codes shown when MFA was turned on. Each one can stand in for an authenticator code once. Type it on the Use a backup code screen; capitals and dashes do not matter.
After a successful backup-code sign-in, Biznsbook sends a recovery email. If you still have the authenticator app, ignore it. If you lost the app, click the link: it turns MFA off so you can set it up on your new phone from My account.
Wrong backup codes count toward the same lockout as wrong passwords, so codes cannot be guessed. After repeated wrong attempts, sign-in is locked for 15 minutes.
When an administrator resets MFA
If a user has lost both the phone and every backup code, a company administrator can reset MFA. In Management, Manage users, users with MFA show an MFA on label; More actions, Reset MFA turns it off for that user after a confirmation.
The administrator should confirm who is asking before resetting, for example by calling the person on a known number. The user is emailed that an administrator reset their MFA, and the reset is recorded in the security audit log.
After a reset the user signs in with their password and sets MFA up again. If their role requires MFA, they are taken straight to the setup page.
Preventing the next lock-out
Keep backup codes somewhere other than the phone that runs the authenticator app, such as a password manager or a printed copy in a locked drawer.
Check the Manage MFA page now and then: it shows how many unused backup codes are left and warns you when only a couple remain. Create a new set before you run out.
When you replace your phone, move the authenticator account or set MFA up again before you wipe the old phone.
Metrics to track monthly
- Users with MFA on
- Administrators without MFA
- Account lockouts this month
- MFA resets by administrators
Start with three metrics; trend direction matters more than a single point-in-time snapshot.
Password-only sign-in vs Biznsbook MFA
Compare password-only sign-in with Biznsbook backup code sign-in and the related sign-in protections.
| Capability | Manual / Spreadsheet | Biznsbook |
|---|---|---|
| Lost phone | ❌ Account unusable | ✅ Sign in with a one-time backup code |
| Removing MFA | ❌ Help desk turns it off on request | ✅ Emailed recovery link, or an audited administrator reset |
| Guessing codes | ❌ Unlimited tries | ✅ Sign-in locked for 15 minutes after repeated wrong attempts |
| User informed | ❌ Not told | ✅ Emailed when MFA is reset or turned off |
| Who can reset | ❌ Unclear | ✅ A company administrator with user management rights |
| Evidence | ❌ None | ✅ Recovery and reset events in the security audit log |
Agreeing a recovery routine
Decide who in the company may reset MFA, how they confirm a caller's identity, and where backup codes should be kept. Write it into your onboarding notes so every new user saves their codes on day one, and remind users to set MFA up again straight after any recovery.
Write the MFA and recovery routine into your onboarding notes for new users.
Frequently asked questions
I lost my phone. How do I sign in?
Enter your email and password, click Lost your phone? Use a backup code on the code screen, and type one of your saved backup codes.
What happens after I use a backup code?
You are signed in, that code is used up, and Biznsbook emails you a link to turn MFA off so you can set it up again on a new phone.
I have no backup codes left. What now?
Ask your company administrator to reset your MFA from Manage users. They should confirm who you are first. You are emailed when it is done.
Why was my backup code rejected?
It was already used, or a newer set replaced it. Use another code from your newest set.
Can an administrator reset their own MFA this way?
No. Administrators cannot reset their own MFA, a SiteAdmin's or a Company Group Owner's from Manage users; they use their own backup codes and recovery email.
What if I keep entering wrong codes?
After repeated wrong passwords or codes, sign-in is locked for 15 minutes. Wait, then try again.
How this differs by industry
Retail
A shop owner whose phone is stolen signs in with a printed backup code, follows the recovery email, and sets MFA up again on the replacement phone the same day.
Wholesale & distribution
An accounts clerk with no backup codes left calls the finance manager, who confirms it is them and uses Reset MFA in Manage users.
Manufacturing
A plant administrator keeps two backup codes in the office safe so a broken phone never stops the morning production run.