Lost your 2FA phone?

At NC State, most people use a phone as their primary two-factor authentication method to log in securely to university accounts and services. But what can you do if your phone is lost or stolen?

Be prepared. Proactively enroll multiple methods of two-factor authentication to ensure your access to university accounts and services. This way, you won’t be stuck if your phone is lost or stolen.

All NC State employees are required to enroll in Google 2-Step to protect Google services and in Duo Security for Shibboleth authentication, which is used to sign in to university web-based services like the MyPack Portal and Microsoft Office 365. These two-step login processes “double check” your identity when you sign in to an account by requiring you to log in with a password and an additional security measure, including a push notification to your device, a security code that is delivered via mobile app, SMS text or a U2F security key. Both processes make it extremely difficult for a hacker to breach your account and thwart up to 98 percent of all phishing attacks.

For Google 2-Step and Duo, you can choose your preferred authentication method at login. You can:

  • Enroll a USB U2F security key to use with Chrome. These keys are physical devices similar to a flash drive and are best kept on a key ring for easy access.
  • Enroll your tablet or second smart device to receive push notifications or generate login codes.
  • Print Google 2-Step “backup codes” and secure them in a wallet, locked drawer or other secure location.
  • Provide additional phone numbers, including land-lines, for Google 2-Step.
    If you have an office phone or a home phone number, you can choose to receive codes by automated voice call.

If your phone is lost or stolen and you do not have another method of authentication:

  • Contact the NC State Help Desk at 919.515.4357 (HELP) for assistance.
    The help desk will verify your identity and issue you a recovery code to access your account.
  • After using the recovery code, add an alternate authentication method to your account at least until you regain access to your phone.

You should also:

  • Use services like Apple’s Find My iPhone and Google’s Find Your Phone or Device to view your phone’s location on a map and lock it.
  • Erase your phone’s content immediately, if you conclude your phone is irretrievable.

Together, all of us in the Wolfpack Community — students, faculty and staff — can form a chain of protection around our personally and university-owned information. Be a strong chain link: use multiple authentication methods.