PanicStation.org
UK USA
us Technology & digital loss

What to do if…
you cannot find your account recovery or backup codes when you need to sign in

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause, make sure you are using the real service, then try a trusted device that is already signed in or the provider’s official recovery flow. Do not pay unofficial “recovery” helpers or share one-time codes with anyone.

Do not do these things

  • Don’t click sign-in links from unexpected messages while you are stressed; type the site address yourself or use the official app.
  • Don’t pay anyone offering account recovery services or share one-time codes, backup codes, recovery codes, passwords, or screenshots with them.
  • Don’t keep retrying guesses until the provider blocks more attempts; stop when the provider tells you to wait or try another route.
  • Don’t turn off multi-factor authentication just to get through the moment, unless the official recovery flow requires a temporary change.
  • Don’t upload ID documents to random sites; only provide identity proof inside the provider’s official recovery process.

What to do now

  1. Confirm you are on the legitimate sign-in path.
    Use the official app, a saved bookmark you trust, or manually enter the service’s address in your browser. If the page looks unusual, has a misspelled address, or creates pressure to act urgently, stop and reopen the service another way.

  2. Do one short, structured search for the missing codes.
    Check your password manager secure notes, encrypted vault, printed emergency sheet, notebook, downloads folder, screenshots, cloud drive secure folder, and any setup email you may have sent yourself. For a Google account, also search your computer for a downloaded backup-code file name that includes the account username. Then stop searching and move to recovery.

  3. Use a trusted device or session that is already signed in.
    If you are still logged in on a phone app, tablet, browser profile, or old laptop, go to the account’s security or sign-in settings. Generate a new set of backup codes if the provider offers that, add or update a sign-in method you control, and review devices or sessions you do not recognize.

  4. Try the alternate verification options already on the account.
    Look for options such as “Try another way,” “Other ways to sign in,” a trusted-device prompt, authenticator app approval, security key, backup email, phone verification, or another recovery contact you still control. Choose only methods that are shown inside the official sign-in flow.

  5. Use the provider’s official account recovery process if you cannot sign in.
    Start from the provider’s official “forgot password,” “can’t sign in,” or account recovery page. Give answers you genuinely know, such as previous passwords, familiar devices, approximate account details, billing details for paid services, or recovery contact information. If the provider says to wait, limits attempts, or gives a retry instruction, stop and follow that instruction rather than guessing repeatedly.

  6. If you regain access, do a quick compromise check before moving on.
    Change the password to a unique one, review recent sign-in activity, sign out unknown sessions, check recovery email and phone details, remove unknown forwarding rules, review connected apps, and replace old backup codes with a new set stored somewhere safer.

  7. If money, identity theft, or fraud may be involved, use official US reporting routes.
    Contact the affected bank, payment service, workplace, school, or account provider using contact details from its official website or app. If identity theft is possible, use the federal identity theft recovery resource. If fraud, scams, or account takeover are involved, consider reporting through the FTC or the FBI’s Internet Crime Complaint Center.

What can wait

  • You do not need to rebuild your whole security setup right now.
  • You do not need to choose the perfect future sign-in method today.
  • You do not need to change every account at once unless the same password or recovery email is involved.
  • You do not need to answer every alert immediately; prioritize the email or phone account that controls password resets for other accounts.

Important reassurance

Losing backup codes is common, and many providers have official recovery routes for this situation. The safest next move is to slow the process down, avoid unofficial helpers, and work only through trusted devices and official pages.

Scope note

These are first steps to regain access safely and reduce immediate takeover risk. Later decisions, especially where money, identity theft, work accounts, school accounts, or legal consequences are involved, may need help from the provider, your bank, your workplace, your school, or another appropriate specialist.

Important note

This is general information only, not legal, financial, cyber security, therapeutic, or other professional advice. If money, benefits, employment, school access, or identity misuse may be involved, prioritize official provider, bank, employer, school, and US government reporting routes.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us