Traded In the Old Phone Over the Holidays? The Lockout That Arrives in January

Technology, February 11, 2026: The Merrill household did what a lot of households do in the last week of December: two new phones arrived, the carrier's trade-in envelopes were sitting on the counter, and the old handsets went into the mail before New Year's Day because the promotional credit expired at the end of the billing cycle. Both phones were wiped first, carefully, following the carrier's own instructions. Contacts moved. Photos moved. The authenticator app, which generates the six-digit codes that four of their accounts required, did not move, because nothing in the transfer process asked about it and nothing warned that it would be left behind.

The problem did not surface for eleven days. It surfaced on a Tuesday morning in January, when the household's primary email account, the one that every other account uses for password resets, asked for a code that no longer existed anywhere.

The password was never the thing that failed

Both adults in the house could recite the password. It was long, it was unique to that account, and it had been sitting in a password manager since the previous spring. None of that mattered. The account had been set up with a second factor, an app-generated code tied to a specific device, and the second factor was the piece that had gone into a recycling stream somewhere in the Midwest. This is the shape most modern lockouts take. The credential is fine and the recovery path is broken, and households discover the difference only when they are already standing on the wrong side of it.

There had been recovery codes. The provider had displayed them at setup, ten strings of characters with a plain instruction to print them or store them somewhere other than the phone. Whoever set the account up had clicked past that screen, which is the single most common version of this failure and carries no judgment with it. The screen appears once, during a task the user is trying to finish, and the consequence arrives a year later attached to a completely unrelated event.

The rules underneath had already changed, and mostly in the household's favor

The advice the Merrills grew up with, mandatory changes every ninety days, a symbol and a number and a capital letter, was formally retired years ago by the people who wrote it. The National Institute of Standards and Technology is responsible for the federal digital identity guidance that banks, employers, schools and software vendors take their cues from, and the direction of travel there has been consistent: length beats complexity, forced rotation on a calendar makes passwords worse rather than better, and the useful screening happens against lists of credentials already exposed in breaches. That change is why the household's email password, a long phrase set once and never rotated, was genuinely strong.

The same shift explains why second factors have become the point of failure. Once the password stopped being the weak link, providers leaned on the second factor much harder, and the second factor is a physical thing living on a device that gets replaced roughly every three years. The rules that now matter to an ordinary household are not rules about characters. They are rules about recovery: how long a provider will hold an account before it releases it, what identity documents it will accept, and whether a code can be re-issued to a new device or must be rebuilt from scratch.

Three weeks of ordinary weekday friction

The email provider's recovery process was automated and unhurried. The first submission, from an unfamiliar computer on an unfamiliar network, was declined within an hour with no explanation, which is by design, because an attacker who knows a password is exactly the person who would file that form. The second attempt, made from the household's own laptop on the home Wi-Fi, after a wait, moved to a review queue with a stated multi-day hold. Nothing about the process could be accelerated by calling, because there was no number to call. The household spent that stretch cut off from a calendar, a decade of correspondence, and the reset path for everything else.

The bank was easier, and the reason is worth noting: it had a branch, an identity check against a driver's license, and an employee empowered to reset the second factor across the counter on a Thursday afternoon. The pharmacy portal was easier still. The utility account required a callback to a number already on file, which happened to be the landline nobody had canceled. The accounts that caused real trouble were the ones with no human channel and no independently verified contact point, which turned out to be a useful sorting rule the Merrills had never thought to apply.

What the shop actually did, and what the invoice covered

They called a local computer repair business in the second week, mostly to stop guessing. The shop billed by the hour with a one-hour minimum and quoted plainly over the phone, and the work ran past the minimum because the technician insisted on doing it in the right order rather than the fast one. He inventoried every account tied to the email address, which took most of the first sitting. He established a second, separate recovery address on a different provider. He moved the household off app-only codes for the accounts that supported hardware keys and passkeys, and he bought two small security keys, billed at cost on the invoice alongside the labor.

The recovery request cleared on its own during the third week, before the technician's final visit, which meant the last billed hour went to cleanup rather than rescue. He printed the new recovery codes, put them in an envelope, and told the household where envelopes like that belong: with the passports and the birth certificates, not in a desk drawer with the takeout menus. The Federal Trade Commission publishes consumer guidance on account takeover and recovery for exactly this situation, and the technician's sequence tracked it closely, which is a reasonable sign that a shop is working from something other than instinct.

The hour that belongs on the calendar

The lesson the Merrills took was seasonal, not technical. Phone upgrades cluster in December and January, around holiday gifts and promotional trade-in windows, and that is precisely when authenticator apps get orphaned, so the week before a handset leaves the house is the week to move the codes, not the week after. They now hold one hour in early December for it: open the authenticator, confirm every entry has been migrated or re-enrolled, reprint the recovery codes for the two accounts that anchor everything else, and confirm the phone number and backup address on file are both current.

It is a short list of chores attached to a predictable date, and it costs nothing. The alternative is a three-week gap in the middle of January, an invoice for labor that was never the household's fault, and the discovery that the strongest password in the house was not the thing keeping anyone out.