Every week someone trades in a phone, opens their laptop, and finds they cannot get into email, banking or payroll. The codes that prove who they are lived on the old phone, and the old phone has just been wiped. Ten minutes before the handover would have saved days of account recovery.
In short
Authenticator codes do not always follow you to a new phone. Many have to be moved or set up again by hand.
Keep the old phone switched on and unwiped until every account has been tested on the new one.
If the old phone has already gone, stop guessing and call your IT contact. Most work accounts can be reset.
Why this catches people out
A new phone restores your photos, messages and apps from a backup, so it feels finished. The authenticator app is there too. Open it, though, and it may be empty, or it may show your accounts but refuse to approve anything.
That is deliberate. The secret behind each six-digit code is tied to the device it was set up on, precisely so nobody can copy it. Some apps back those secrets up. Some only do it if you switched the backup on beforehand. Work and school accounts often need registering again on the new phone, whatever the backup says.
Before you touch the old phone
Keep both phones. Do not wipe, trade in or hand back the old one yet. Keep it charged and on Wi-Fi.
List what is in the authenticator. Open the app on the old phone and write down every account in it. Each one needs to work on the new phone before you finish.
Check for more than one app. Many people have two or three: one for Microsoft 365, one for Google, one the bank insisted on.
Moving the common ones
Microsoft Authenticator. Switch on backup in the app's settings on the old phone, then sign in and restore on the new one. Then check each account. Work or school accounts usually show a prompt to finish setting up: follow it, or sign in to your Microsoft 365 security settings on a computer, add the new phone as a sign-in method, and approve it with the old phone.
Google Authenticator. Sign in to your Google account inside the app so the codes sync, or use the transfer option on the old phone, which shows a QR code for the new phone to scan.
Codes kept in a password manager. If your codes live in a password manager, they arrive when you sign in to it on the new phone. Check that you can sign in to the manager itself first.
Everything else. For any account that will not move, sign in to that service on a computer, go to its security settings, and add the new phone as a new authenticator. The old phone approves the change. That is why it has to stay alive.
Test before you wipe
Sign out of one important account and sign back in using only the new phone.
Do the same for email, banking and payroll. Those are the ones that hurt.
Check that codes sent by text arrive on the new phone, if your number has moved to a new SIM or eSIM.
Only when every account on your list has worked on the new phone should the old one be wiped.
Two things worth doing today, new phone or not
Save your backup codes. Most services offer a set of one-off recovery codes when you switch on two-step sign-in. Store them in your password manager, not on the phone.
Register a second method. A second device, a security key or a phone number means one lost phone is an inconvenience, not a lockout.
Already wiped it?
Do not keep trying codes: too many failed attempts can lock the account for longer. For work accounts such as Microsoft 365 and Google Workspace, your IT administrator can reset your sign-in methods so you can register the new phone. For personal services, use the backup codes if you saved them, or the provider's account recovery process, which can take several days.
Getting a new phone soon?
Tell us before you trade the old one in. We will sit with you, or share your screen, and move every authenticator across in one go. If you are already locked out, we can usually get your work accounts back the same day. Talk to us, or see how managed IT takes care of this for the whole team.