With two-step verification on, logging in also requires the 6-digit code from an authenticator app on your phone after your password. Even if someone gets hold of your password, they can't get into your account.
If your phone isn't with you, you can enter one of the recovery codes instead of the authenticator code when logging in. Each code works once. The security page shows how many codes are left, and you can generate new ones at any time.
Log in with a recovery code and set up 2FA again on your new phone. If you've lost both the phone and the recovery codes, write to support — 2FA can be turned off once your identity is confirmed.
Was this article helpful?