Authenticator codes don't move to your new phone on their own
An authenticator app generates codes right on the phone: there's no default "cloud" that carries them to a new one unless the app does it for you. If you don't check this first, you lose access to every account it protects.
In short: every authenticator app decides for itself whether it backs up your codes. If it doesn't, those codes exist only on that phone. It hits hardest the people using a "simple" app they assumed was safer for not depending on any account.
What happens
The six-digit code in your app comes from a secret generated the first time you scanned a service's QR code. That secret lives on the phone. If you switch phones and the app hasn't saved it anywhere else, the secret stays on the old one. The code on the new phone, if there is one, won't match what the service expects.
Not every app behaves the same way. Google Authenticator, for example, backs up automatically if you're signed into your Google account inside the app itself: sign in with that account on the new phone and the codes just appear. There's also a manual route, for people who don't want to link an account: on the old phone you export the chosen accounts to a QR code, and the new phone imports them by scanning it. If you protect a lot of accounts with the same app, the old phone may need to generate more than one QR code to fit them all — scan all of them before calling the transfer done. Other apps (the ones that keep an end-to-end encrypted backup in their own cloud) use their account or a recovery password; apps that offer neither option simply don't move, and each account's secret is lost with the phone.
Why it happens
By design. The standard behind these codes (TOTP) includes no sync mechanism of its own: each app adds one, or doesn't. The more "minimalist" apps without an account or cloud exist, the easier it is to pick one thinking it's the most private option, and then find out later it's also the one with no safety net. The privacy of not depending on any account and the convenience of having a backup pull in opposite directions: each app resolves that tension its own way, and rarely explains it clearly before you install.
Who it hits hardest
People who use a different authenticator app for each account without checking whether it backs up, people who uninstalled the app from the old phone before checking anything on the new one, and people who bought the new phone to replace a broken one: there's no "old phone" to copy from. It also hits people who switch Google accounts (for example, moving from a personal account to a work one) without realizing their Google Authenticator backup was tied to the old account, not to the app itself.
What to check before you switch
- Do you know if your authenticator app backs up to an account, or only lives on this phone?
- Do you have the backup codes for every important account saved outside your phone?
- Are you keeping the old phone on with the app installed until you confirm the new one already has the codes?
- Do you know exactly which accounts use 2FA through this app (not just "the important ones")?
If it already happened to you
If you already wiped the old phone or lost it and the app didn't back up, there's no way to recover that secret: you have to go into each account through its official recovery path (backup code, recovery email or phone, or the service's own support process) and set up two-step verification again from scratch. There's no safe shortcut: be suspicious of any page that asks for your old code or your password to "recover" it.
Official sources: Google Authenticator: transfer accounts