A lost phone with your only authenticator is not an IT ticket. It's a lockout with a deadline — and the deadline is whenever that phone turns up in someone else's pocket.
I've sat through two of these now, and both times the same thing almost went wrong: the reset happened before the verification. Someone "helpful" reset the MFA because the person sounded stressed on the phone. Here's the runbook we wrote down after the second time.
Treat the lost factor as compromised, not missing
Lost does not mean wiped. The TOTP app or push prompt on that phone can still approve logins until someone revokes it. "MFA device lost" means "second factor compromised until proven otherwise" — the same assumption you'd apply to a leaked API key. You don't wait to find out.
And know this: lockout is when people get phished. A locked-out employee who "just needs back in" is exactly the state attackers exploit — including the phisher who calls two hours after the real employee, claiming to be the same person. The verification step isn't paranoia; it's the whole ballgame.
Verify out-of-band before you touch anything
Live video call with a face you know, or a call to a number on file that is not the lost phone. Never verify over the same channel that was lost — email reachable from the lost device is not verification, it's theater. Two checkpoints minimum: face-to-name, plus a knowledge check your own records can confirm.
Then write down who verified whom, and when. If that phone later surfaces in a fraud attempt, that log line is the difference between an audit note and an incident with no timeline.
The reset order matters
- Revoke the lost factor first — admin console, "revoke MFA methods," not "reset password." The password was never lost. This closes the compromise window.
- Revoke sessions and refresh tokens — the old phone may hold live sessions that survive an MFA change.
- Enroll the replacement — a new TOTP app on a device the employee still holds.
- Inventory the keyring — if the phone held the password manager app, rotate the master password; if it was the backup email's second factor, that chain breaks too. A lost device is a keyring, not a key.
Keep the business running through the lockout
Forward the customer-facing mailbox to a live teammate during the dead hours — then turn the forwarding off afterward; silent forwarding is the classic business email compromise hole no matter what triggered it. A second admin (or your break-glass account) covers console actions in the meantime.
That break-glass account deserves its own line: one cloud-only admin identity, long generated password sealed offline, tested quarterly, every use logged. Build it the day after the incident, not the day of.
The fix that makes the next loss boring
Backup codes. Every provider offers one-time recovery codes, and every small team skips them. One hour, every employee, codes generated and filed in the password manager. Then one live rehearsal: an admin revokes a volunteer's MFA on a quiet Friday, and the team runs the whole runbook end to end. Twenty minutes. The first real loss should be the second time you've done this, not the first.
The full runbook — including the reset order, the break-glass build, and the quarterly factor pass — is one page of the HIVE80lab ops notes. If you're starting from zero on this stuff, The First 30 Minutes is a free incident quick-start, the Ops Starter Kit is the $14 incident-response kit, and the Ops Mega Bundle is all five kits in one download.
Top comments (0)