Locked Out by 2FA? Why Microsoft and Google Keep Asking — and How to Get Back In

If it feels like Google and Microsoft ask you to "verify it's you" far more than they used to, you're right. A new device, a new location, a VPN, or just a while since your last sign-in can all trip a suspicious-login check, and most accounts now require two-factor authentication (2FA) on top of your password. It's good security — and it's also the number-one reason people get locked out of their own email.

The many ways they ask you to verify

You'll run into several: a code by text (SMS), a code by email, a code from an authenticator app (Google Authenticator or Microsoft Authenticator), a "tap Yes on your phone" prompt to a trusted device, or a passkey. Which one you're offered depends on what you set up — and, increasingly, on which one the provider trusts most in that moment.

Why SMS and email recovery often don't work anymore

Here's the part that frustrates people: Google in particular has grown wary of text-message and email recovery, because both can be phished or hijacked (SIM swaps, compromised inboxes). So during a recovery it may hide or refuse those options and instead push you toward a device you've signed in on before, or an authenticator app.

In practice that means recovery can take several attempts and a few different routes before one is accepted. The single biggest thing that helps: do it from a device, browser, and location you've used with that account before — the system trusts familiar context and is far more likely to let you through.

How to reset your password

Google: go to accounts.google.com, choose "Forgot password," and follow the prompts — ideally on a phone or computer already signed into the account, which dramatically improves your odds.

Microsoft / Outlook / Hotmail: go to account.live.com password reset and work through the identity checks. Microsoft may ask for security-info codes and, if those fail, a recovery form with details only you would know.

Either way, if the first method stalls, look for a "Try another way" link and work through the options — persistence with the right device usually wins.

Why this is especially hard for older folks

For people who didn't grow up with this — and who may already find a keyboard, mouse, or touchscreen tricky — these verification gauntlets can be genuinely overwhelming. Codes expire in seconds, you're bounced between your phone and your computer, the text is tiny, and you're asked to install an app in the middle of signing in. It's no wonder a simple "just check your email" turns into hours of frustration and, too often, getting locked out of an account you've had for years.

A big part of our work — especially across the desert and retirement communities we serve — is sitting down with someone, patiently, and getting them back into their accounts without the panic. We don't rush, we explain each step in plain language, and we set things up afterward (a trusted device, a passkey, fewer prompts) so it's far less likely to happen again. If this is you or a parent, that's exactly the kind of call we like.

Set yourself up so it doesn't happen again

A few minutes now saves a lockout later: install an authenticator app and save the backup/recovery codes somewhere safe; keep your recovery phone number and email current; register your main devices as trusted; and consider a passkey, which both companies now prefer over SMS.

If you're stuck in a verification loop, or you just want 2FA set up so it protects you without locking you out, we do this all the time — we'll walk through recovery with you and get your accounts onto methods that actually stick.