Two-factor authentication locking me out of vendor account
Vendor support can usually bypass 2FA for verified account owners. Contact them with your details.
Yeah, I learned this one the hard way. I set up 2FA on my vendor account a few months ago, scanned the QR code into my authenticator app — everything worked fine. Then I got a new phone and wiped the old one before I even thought about transferring my TOTP seeds. Next time I tried logging in, I got the 2FA prompt, opened my authenticator… nothing there. No code, no account. I was completely locked out.
The error was pretty straightforward: after entering my username and password, the page just sat on the "Enter your 6-digit code" screen. No error message, just a blank field and a spinning timer. I tried refreshing, clearing cookies, even switching browsers and devices. Same result. I contacted vendor support, but without any proof that I owned the account (can't pass 2FA, can't prove identity), they told me recovery would take days and might require notarized documents. So yeah, not a fun experience.
The fix is exactly what you said — those backup codes you get at setup. I actually had saved mine in a password manager as a note, but I'd forgotten about them. So I dug into my manager, found the ten one-time codes, used one to log in. Then immediately I disabled 2FA, re-enabled it, and this time I printed the new backup codes and put them in my safe. I also exported the TOTP seed as a QR code image and stored it encrypted on a USB drive.
My advice: when you first enable 2FA, treat those backup codes like the nuclear launch keys. Save them in at least two places — one offline like a printed paper in a safe, and one encrypted digital backup using something like Bitwarden, KeePass, or a VeraCrypt container. Test that one of the codes works right after setup so you know they're valid. Also, if your authenticator app supports cloud backup (like Authy or 2FAS), enable that before you switch phones. And don't just rely on one method — combine seed export, backup codes, and maybe even a hardware security key if the vendor supports it. Takes five minutes now, saves you a week of frustration later.
Order confirmation email is good proof of account ownership for recovery purposes.
If 2FA is locking you out: most vendor platforms have a backup code system generated at account setup. Check if you saved those. If not, account recovery usually requires verifying your registered email and original order details. Contact vendor support with this information.