MFA that survives a lost phone

A phone goes in a lake on a Friday afternoon. The replacement arrives Tuesday. Between those two facts is a business owner locked out of email, the bank, the payment processor and the domain registrar — because the six-digit codes for all of them lived on that phone, and that was the whole point.

Multi-factor authentication is the single best security control a small organization can turn on. The failure mode is not that it gets bypassed. It's that it works exactly as designed against the person who owns the account.

What actually happens when the phone is gone

An authenticator app isn't tied to your phone number, and by default it doesn't sync anywhere. Each account you enrolled handed the app a secret at setup time, and that secret sits on that device. Wipe it, drown it, or factory-reset it and the secrets are gone. There's nothing to recover, and the account has no way to tell you apart from someone claiming to be you.

What follows is identity-verification paperwork and hold music, one account at a time. Some vendors sort it out in a day. Registrars and banks do not.

SMS is a factor, but a weak one

Text-message codes have two problems and only one of them gets talked about.

The one you've heard: a phone number is not a strong identifier. Numbers get moved between SIMs, and the process that moves them is a customer-service process, not a cryptographic one. That's a whole class of account takeover, and it's why anything guarding money or a domain shouldn't lean on SMS.

The one that bites more people: SMS fails in the ordinary case too. No phone, no code. No signal in the back of the shop, no code. And on a lot of services SMS is quietly left enabled as the recovery method for the stronger factor, which drags the account down to the weakest thing protecting it.

SMS beats no second factor. Use it where a service offers nothing else, and turn it off where you've done better.

Enroll more than one thing, on more than one object

The fix is not exotic. It's redundancy, decided at setup rather than at 4pm on a Friday.

Two authenticator enrollments, not one. When a service shows you the QR code, scan it into two apps on two devices — a phone and a tablet, or a phone and a desktop authenticator. It's the same secret, it takes ten extra seconds, and it means one drowned phone doesn't lock you out. You cannot do this retroactively; you have to do it while the QR code is on screen.
Hardware security keys for the accounts that matter. A FIDO2 key (YubiKey is the common one) is phishing-resistant in a way codes are not — it will only sign in to the real site. Buy two, register both, keep one on your keyring and one in a safe.
Passkeys, where offered, are the same technology with the key stored in a phone or password manager and synced between your devices — convenient, and worth noticing that whatever they sync through is now protecting the account.
Recovery codes for everything, printed at setup.

The circular dependency nobody warns you about

Here's the part the setup wizards skip. Most people who do save their recovery codes save them into the password manager. Sensible — right up to the moment the password manager's own second factor is the app on the phone that's gone. Now the codes that recover everything are behind the one thing you can't get into.

Your recovery path has to be independent of the thing it recovers. Print the codes for the handful of accounts that matter, put them in an envelope in a safe or a lockbox, and treat that envelope as the physical key to the business. It is one.

And there's an order to this. Email and the domain registrar come first, before the bank, before anything. Password resets for every other service land in your email, and control of your DNS means control of where that mail goes. Secure those two with a hardware key and printed codes and every other account has a working way back. Leave them on SMS and everything else you did is decoration.

If you run Google Workspace or Microsoft 365, add a second administrator account with its own key and codes, not enrolled on your phone and used for nothing else. When the main admin is unreachable, that's what gets you back in.

What to do

List the accounts that would stop the business if you lost them for a week. Email and the registrar are at the top whether they feel like it or not.
For each, open the security settings and count the enrolled factors. One is a single point of failure.
Re-enroll where you need to, scanning each QR code into two devices.
Buy two hardware keys and register both on the accounts at the top of the list.
Print every recovery code and keep them somewhere physical and locked.
Once a year, sign in with the backup method. An untested recovery path is a guess.

Locked out, or want this set up before you find out the hard way? Support requests come straight to me.