# Oops, I lost my phone. How can I OTP now?
**URL:** https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899
**Category:** Support
**Created:** [11 במרץ, 2020, 11:33am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899 "2020-03-11T11:33:05Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [11 במרץ, 2020, 11:33am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/1 "2020-03-11T11:33:05Z")
What happens if you implemented two-factor authentication with your phone and you lost it?
How to recover and use another program, e.g., [pass-otp](https://github.com/tadfisher/pass-otp), instead?
Since one cannot login without the second factor, how to get the tokens (secret, issuer) that will allow to setup another program?
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [11 במרץ, 2020, 11:37am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/2 "2020-03-11T11:37:08Z")
You’ll have to disable 2FA through rails console. Discourse doesn’t have a built in SMS/Email based recovery mechanism as of now.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [11 במרץ, 2020, 2:26pm UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/3 "2020-03-11T14:26:32Z")
Discourse have backup tokens, which are to be used if you lose your OTP device.
You can also register the OTP in multiple devices.
FIDO2 keys can also be used, and Discourse support using multiples, so you can have backup keys stored in safe places, your main one, and the ones who are backed into your device, like Android fingerprint and Windows Laptop Hello devices.
If you did neither, you will have to contact the admin team and ask then to disable 2FA on your account.
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [11 במרץ, 2020, 3:55pm UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/4 "2020-03-11T15:55:02Z")
> [@itsbhanusharma](#):
>
> You’ll have to disable 2FA through rails console.
> [@Falco](#):
>
> contact the admin team and ask then to disable 2FA on your account.
OK, can you please point to the procedure to disable 2FA from the console?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [11 במרץ, 2020, 3:56pm UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/5 "2020-03-11T15:56:57Z")
Search “disable 2fa” first result says
> [@How to disable 2FA](https://meta.discourse.org/t/how-to-disable-2fa/131475/11):
>
> The alias changed since we have multiple totps now. Also that command would remove all totp instances across all users… You probably want to do the following as the second command: UserSecondFactor.totps.where(user\_id: id).each(&:destroy!)
So:
```plaintext
./launcher enter app
rails c
id = User.find_by(username: "YOURUSERNAME").id
UserSecondFactor.totps.where(user_id: id).each(&:destroy!)
```
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [12 במרץ, 2020, 10:42am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/6 "2020-03-12T10:42:39Z")
Well, actually, after following the method above, I’m left without the possibility to log in, even via email with the following message:
> The selected second factor method is not enabled for your account.
I had another admin verify that the account had no 2FA enabled.
* * *
**EDIT** I recast the topic to #Contribute > Bug because the proposed solution is not working.
---
### Author:  [@hellekin](https://meta.discourse.org/u/hellekin)
#### Post date: [19 במרץ, 2020, 11:22am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/7 "2020-03-19T11:22:11Z")
Today I looked at it again and found that:
```ruby
[25] pry(main)> how.totp_enabled?
=> false
[26] pry(main)> how.backup_codes_enabled?
=> true
[27] pry(main)> how.totp_or_backup_codes_enabled?
=> true
```
So I tried to remove the backup codes as well, following the response above from @falco:
```ruby
UserSecondFactor.backup_codes.where(user_id: id).each(&:destroy!)
```
Now here is the complete solution to disable OTP for a user when they lost their ways back in: **you must remove both the `totps` entries and the `backup_codes` as well** , so that the call to `#totp_or_backup_codes_enabled?` returns false.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [18 באפריל, 2020, 11:22am UTC](https://meta.discourse.org/t/oops-i-lost-my-phone-how-can-i-otp-now/143899/8 "2020-04-18T11:22:21Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.