Locked Out of Duo or Lost Your MFA Device
Locked Out of Duo or Lost Your MFA Device
A lost or stolen authentication device is both an access problem and a security incident. Act promptly, but do not bypass normal identity verification or accept help from anyone asking for credentials. The safest next step depends on whether you still have another method already enrolled.
If the phone or authenticator is lost or stolen
- Do not send a Duo Push to the missing phone and do not approve any request that appears on another device unless you initiated it.
- Contact Zerolimit as soon as possible so the missing device can be reviewed and disabled for authentication. Also follow your organization’s process for reporting lost equipment.
- Use your mobile carrier’s and device vendor’s official lost-device controls to suspend service, lock the phone, or erase it when appropriate. These actions do not automatically remove the device from Duo.
- Change your work password through the organization’s official password-reset process if there is a reasonable chance the password was exposed. Do not follow a password-reset link sent by an unknown person.
Duo’s user guidance says that an administrator can disable a missing phone and help you use another method. If self-service is enabled and you previously enrolled a second device, you may be able to authenticate with that second method and delete the missing phone from device management. Removing a phone yourself is appropriate only when you are certain you selected the missing device and have already confirmed that another method works.
If you still have another enrolled method
At the Duo prompt, look for Other options, Other methods, or a device selector. Depending on policy, you may be offered a security key, platform authenticator, Duo Mobile passcode from another activated device, hardware token, phone call, or text passcode. Use only a method already associated with you and displayed by the legitimate Duo prompt.
After you sign in, open the Duo device-management page if available. Add and test the replacement method before removing the old one. Availability and labels vary by application and organizational policy. If no management option is visible, do not improvise; contact Zerolimit.
If you have no working method
Stop trying to sign in and contact Zerolimit. Duo’s device-management portal itself requires authentication, so it cannot solve a total lockout when no enrolled method is accessible. Zerolimit may need to verify your identity, review the device status, provide an organization-approved temporary recovery path, and enroll a replacement. The verification process is intentionally stricter than ordinary troubleshooting.
A bypass code, when permitted, is generated or provided under administrative control. Treat it as a password: enter it only in the legitimate Duo prompt, use it only for its approved purpose, and never send it by email or chat. Zerolimit will not ask you to read a code back after you have entered it.
If Duo says the account is locked or disabled
Repeated denied, timed-out, or failed attempts may result in a lockout, and policy can also block a device or account. Do not continue retrying, cycle through guessed passcodes, delete Duo Mobile, or reset the phone. Record the exact message and time, then contact Zerolimit. A lockout can also follow suspicious activity, so mention any unexpected pushes, unfamiliar locations, or recent password prompts.
Protect your information during recovery
A legitimate support interaction may ask for your name, username, callback details already on record, device type, application, approximate incident time, and error text. It should not require your password, a current Duo passcode, an activation QR code, a recovery key, or approval of a push you did not initiate. Hide those secrets in screenshots. If someone asks for them, end the interaction and contact Zerolimit through a known support channel.
When to stop and contact Zerolimit
Contact Zerolimit immediately for a lost or stolen device, an account marked locked or disabled, no remaining authentication method, unexpected authentication after the loss, or a device you cannot remove safely. Also stop if a caller pressures you to approve a push or disclose a code. Include the device type, whether it is lost or stolen, the last time it was under your control, the application affected, and the exact Duo message. Never provide a password, MFA code, QR code, recovery secret, or unsolicited approval.
Support safety reminder: Zerolimit will never ask you for your password or an MFA code.