Email, phone and authenticator all gone

One phone goes missing and three things leave with it: the number that receives the codes, the authenticator that generates them, and — if your mailbox was protected by that same authenticator — the inbox that everything else falls back on. That is why “I lost all of it” is so often one loss rather than three.

Lay “everything” out as four layers

Start by separating two things that sound identical: losing the device, and losing access. Phone gone but the setup key copied onto paper — the device went, the access stayed. Phone intact but the setup key existing nowhere except inside it — one drop takes both. The second column is the one that decides how many routes you have left.

People say three things. There are four, and each is present or absent on its own:

• The login password. It lives in your head or in a password manager, and it is not necessarily tied to the handset at all.
• The mailbox itself. The question here is whether you can sign in and read mail right now — not whether you remember the address.
• Ownership of the number. Losing the handset is recoverable with a replacement SIM. A number moved at the carrier is a different problem; see why SMS is the weakest 2FA.
• The seed inside the authenticator — the setup key shown when you first bound the account. Copy it down once and the six digits can be regrown on any device, which is what the backup key article is about.

Passkeys and hardware security keys sit alongside these as a separate route: you either have one or you do not.

Tick the four off and most “I lost everything” turns out to be the last two. The handset is gone, so the number and the seed went together; the password is intact and the mailbox is still signed in on a laptop somewhere. That situation and a genuinely empty set of four call for completely different moves, and two minutes of ticking beats an hour of searching for recovery advice written for somebody else’s case.

Then try the cheapest thing first. Sign in from another device with the password and watch where the flow stops.

The self-service route needs one survivor

Binance documents the self-service reset step by step. What follows paraphrases the English version of that help page, which carries an “Updated on 2026-03-18” stamp (no time zone given on the page); we opened it in a browser and checked it on 2026-09-16.

You enter the email or phone number on the login page. If passkeys were added earlier, a prompt appears first; the page says to click [Cancel] and then choose [My Passkeys Are Not Available]. After the password you reach the Security Verification Requirements page, where the instruction is to “select the verification method that is currently unavailable to you to start the reset process” — the worked example is choosing [Email] when the email is gone, then clicking [Security verification unavailable?] in the pop-up. That leads to the Reset Security Verification page, where you tick every 2FA device you have lost and click [Confirm Reset].

What decides whether this route works for you at all is step 8: “You’ll be prompted to verify via your other available 2FA device(s). Complete all the security verifications.”

Our reading of that sentence: the self-service reset assumes at least one method is still working, because what it does is trade what you hold for what you have lost. With all four layers genuinely empty the flow stops there, and that is the design.

The page also carries a note at step 4 aimed squarely at the worse case: “If you’re unable to reset your password because you can’t access any 2FA, please contact our Customer Support.” That sentence is the official hand-off from self-service to a human.

Password only: what the manual review asks for

Password intact, nothing else: this is the video identity check. Binance keeps a separate English page on how to record it, and its own wording is that you “might need to submit a video to the Customer Service team to verify your request” (checked 2026-09-16).

What that check is about is you, not the devices. The page asks for “the KYC document (e.g., ID card, passport, driver’s license) that you used to verify your Binance account” — the one you verified with, which is not automatically the one in your wallet today. The page does not spell this out, so the warning is ours: if that passport has since expired or been replaced, find out before you start recording rather than halfway through.

The order is fixed. The submission section states: “Please note that you must have attempted manual reset first before you can use the appeal feature.” So the flow in the previous section has to be walked even when you already know it will stop, because that is what opens the appeal door.

What it asks for is physical. Hold the KYC document you originally verified with, front side to the camera, face and document both clearly visible. Read a statement aloud that includes the date, which verification method you are resetting and the account email address. No watermarks, no editing, and a photo of the same document goes in with the video.

English is not required. The page offers a route in plain terms: speak in your preferred language, but write the statement out on a piece of paper, the same three items as the paragraph above, and hold the note in front of the camera together with your ID.

There is an optional set of security questions. Binance says some users are asked for the account registration date and registration IP, and points out both can be found in the registration email whose subject line reads “[Binance] Confirm your Registration From XXX (IP address) - XXX (date)”. Supplying them, the page says, helps confirm your identity and speeds up the review.

The page does not say this, but that registration email lives in the registration mailbox. If the mailbox is the layer you lost, the material that would have accelerated the review is out of reach along with it. Copy the registration date and IP somewhere outside that mailbox — a notes app, a scrap of paper, anywhere that is not that inbox.

When even the password cannot be reset

All four layers empty, password included, and there is no self-service door. The official answer is the support contact that step 4 points to; the identity material is broadly the same as above, except you cannot clear the “attempted manual reset” prerequisite, so it has to start from the support side.

Expect the timing to be open-ended. The up-to-24-hours figure Binance gives applies to a request that already reached [Under Review] through the self-service flow; the help pages put no number on how long an identity check opened from the support side takes. Anyone promising you a specific number of days is not reading it off an official page.

This tier is also where the scams cluster. We ran the English search on 2026-09-16 and commercial “crypto account recovery” services sat on the first page alongside the genuine help articles; the Chinese and Spanish searches the same day returned help centres, forum threads and general security media instead (all three queries are listed in the sources below). That kind of offer does not care which language you searched in, so keep the doors straight: there are exactly two official ones, the [Security verification unavailable?] link on the login flow and the platform’s own support channel.

The identity video from the previous section goes through those same two doors and nowhere else — inside the appeal flow, or in the official support chat. Anything that charges upfront, asks for your password or seed phrase, asks you to send that document-in-hand video or a photo of your ID somewhere else, or wants remote-control software installed is a second loss stacked on the first.

The hours after, and the way back next time

A successful reset does not hand the account straight back in full. The English page states it twice, at the top and at step 7: to protect the account, withdrawals, P2P selling, internal transfers and payment services are disabled for up to about 48 hours after the 2FA devices are reset, and a request sitting at [Under Review] may take up to around 24 hours to process. Both figures are as shown on the page you open at the time (we checked them on 2026-09-16). The practical use of knowing them is scheduling: do not plan anything that moves money on the day you submit the reset.

Four things you can do in advance, none of them costing anything:

• Write the setup key down in two offline places. Paper or a local password manager both work; what matters is that neither copy lives on the same device as the authenticator.
• Harden the mailbox before the exchange. That is our own ordering, and the reason is that the inbox is where most recovery paths begin — when it falls, several routes narrow at once.
• Copy out the registration date and IP. Somewhere other than that mailbox, for the reason in the previous section.
• Stop the number layer depending on one handset. Add a SIM PIN and make sure at least one verification method does not run through the number at all.

Do those four and “I lost everything” downgrades itself to “I lost two layers”, and two layers still has a self-service door.