2FA scratch codes are one-time backup codes that let a user complete two-factor authentication when the normal second factor is unavailable. They are often generated during account setup and are meant to be stored securely for emergencies, such as losing a phone, replacing a hardware token, or being unable to receive a verification prompt.
They matter because they can bypass the usual protections of 2FA if an attacker obtains them. In real intrusions, criminals look for scratch codes in email, password managers, screenshots, or cloud notes, then use them to log in even after the primary password is changed. Defenders should treat these codes like passwords: generate them only when needed, store them offline or in a protected vault, rotate them after use, and monitor for suspicious retrieval or login events. If scratch codes are exposed, the account may remain at risk until they are revoked and replaced.