A 2FA backup code is a one-time recovery code created when multi-factor authentication is enabled. It lets a user sign in if the normal second factor is unavailable, such as when a phone is lost, reset, or out of reach. Because it can replace the second step, it should be treated like a high-value secret, similar to a password or recovery key.
In attacks, backup codes are attractive because they can bypass MFA entirely if stolen. Phishing kits, infostealers, and browser-based theft may collect them from saved files, screenshots, notes, downloads, synced profiles, or password managers. Defenders should store backup codes offline, regenerate them after any suspected exposure, and revoke them when an account is recovered. Stronger MFA methods reduce reliance on reusable recovery secrets, but backup codes remain useful when they are tightly protected.