Forgot Your Exchange Password and Lost Your 2FA? Here Is the Step-by-Step Reset Process

25 October 2026

If you have forgotten your exchange password and also lost access to your two-factor authentication (2FA) - whether through a deleted app, a broken phone, or lost backup codes - you are in a difficult but not hopeless situation. The recovery process varies by exchange, but it generally involves proving your identity through a multi-step verification procedure that can take days or weeks. Below is the typical step-by-step process, along with what you should expect and prepare for.

Step 1: Attempt a Standard Password Reset First

Before assuming you need the full recovery, try the standard password reset option on the exchange’s login page. Most exchanges will send a reset link to your registered email. If you still have access to that email, you may be able to set a new password. However, if your 2FA is still required after the password change - and you cannot generate a code - you will need to proceed to the next steps.

Step 2: Locate the Account Recovery or Support Portal

Every major exchange has a dedicated account recovery or support request form. Look for links labeled “Lost 2FA,” “Account Recovery,” or “Can’t access your account?” on the login page or in the help center. Do not use general contact forms meant for billing or technical issues - use the specific recovery pathway, which is usually separate and more secure.

Step 3: Provide Proof of Identity (KYC Documents)

Exchanges will require you to verify your identity before resetting both password and 2FA. Prepare the following documents:

• A clear photo of your government-issued ID (passport, driver’s license, or national ID card).
• A selfie holding the ID, often with a handwritten note containing the exchange name, today’s date, and the phrase “Account recovery request.”
• Proof of address, such as a recent utility bill or bank statement (issued within the last three months).

Upload these exactly as the exchange requests. Blurry images, expired IDs, or mismatched names are common reasons for rejection.

Step 4: Answer Security Questions or Provide Account History

Some exchanges ask additional security questions you set up when creating the account. Others may request details only you would know, such as:

• The approximate date you created the account.
• The last four transactions you made (type, amount, date).
• The email address used for registration.
• Any previous withdrawal addresses or deposit sources.

Be as accurate as possible. If you are unsure of exact dates, provide your best estimate and explain that you are working from memory.

Step 5: Wait for Manual Review

After you submit the request, the exchange’s support team will review your documents and information. This step is not automated. Expect a response within 24 hours to several weeks, depending on the exchange’s workload and your account’s history. During this time:

• Check your email (including spam folder) for updates or requests for additional information.
• Do not submit multiple duplicate tickets - this can delay the process.
• Be prepared for the exchange to ask for a video call or a more detailed explanation of how you lost access.

Step 6: Reset Your Password and Re-enable 2FA

Once the exchange approves your recovery, they will typically:

• Send a temporary password or a reset link to your verified email.
• Require you to set a new strong password immediately.
• Prompt you to set up a new 2FA method (usually Google Authenticator or Authy). Make backup codes this time - store them offline in a safe place.

Some exchanges will also automatically disable withdrawals for a period (e.g., 24 - 72 hours) after a password or 2FA reset, as a security measure. Do not panic if you cannot move funds immediately.

What to Do If the Exchange Rejects Your Request

If your recovery is denied, you will usually receive a reason - such as insufficient documentation, suspicious activity, or an inability to verify your identity. In that case:

• Review the rejection notice carefully for what was missing or wrong.
• Re-submit with corrected documents (e.g., a clearer photo, a more recent bill).
• If you believe the rejection was in error, escalate to a supervisor or use the exchange’s official complaint process.

Important Considerations

• No shortcuts exist. There is no “backdoor” or hack to recover an account with both password and 2FA lost. Any service claiming to bypass the process for a fee is a scam.
• Time matters. The longer you wait, the harder it may be to remember account details or locate old documents. Start the process immediately.
• Prevention is better. After you recover access, enable multiple recovery options - such as email-based 2FA fallback, hardware security keys, and a backup phone number - so a single failure does not lock you out again.

This process is stressful but standard across the industry. Follow each step carefully, provide accurate information, and be patient. Most legitimate accounts can be recovered, but the speed depends entirely on how well you can prove you are the rightful owner.

Back to account recovery