No Backup Codes? Recovering a Zoho Account Locked by MFA

If you're locked out of a Zoho account by MFA and think you don't have a backup verification code, it's worth checking two things before assuming you're stuck.

Check 1: Did You Save Backup Codes Without Realising?

When you generate backup verification codes, Zoho gives you the option to download them as a file rather than just copying them. If you took that option at any point, the file is likely still sitting in your browser's download history, even if you don't remember doing it.

Where to look: Search your browser's download history for a file with "Recovery-codes" in the name. If you can narrow down roughly when you last set up or reconfigured MFA, search around that date. Check every browser you regularly use, not just your current default, since the file was saved wherever you happened to be signed in at the time.

Once you find a code, see recovering your account with a backup verification code for the sign-in steps by MFA mode.

Check 2: Do You Have a Trusted Browser Somewhere?

If you'd previously marked a browser as trusted, and the trust hasn't expired or been cleared, signing in from that specific browser bypasses the MFA prompt entirely.

Think about which computers and browsers you've used to sign in before, particularly ones you use regularly and haven't cleared cookies on.
Try signing in from each one. If the browser is still trusted, you'll get straight in without an MFA prompt.
Once you're in, reconfigure your MFA method straight away rather than leaving the account relying on that one browser.

See Trusted Browsers: Skipping MFA on Devices You Trust for how trust works and why it can stop working (an incognito window, or a browser set to clear cookies on close, won't retain it).

If Neither Applies to You

If you genuinely have no backup codes and no accessible trusted browser, you can still get back in with a one-time backup verification code issued once your identity is verified.

What You'll Be Asked to Provide

A copy or screenshot of the last automated email you received from Zoho (from noreply@zoho or Zoho), with both the sender and recipient addresses visible.
A reply sent from the actual account mailbox in question, not from a personal or alternate address.
Your organisation's Zoho CRM super admin copied in on that reply, if you're part of an organisation.

Why the identity checks are strict: A backup code that regains account access is a genuine security-sensitive action, so verification exists to confirm the request is genuinely coming from the account owner, not to make the process needlessly difficult.

Once You're Verified

You'll be given a one-time backup code to sign in with. As soon as you're back in, reconfigure your MFA method and generate a proper new set of backup codes, so you're not relying on a repeat of this process if it happens again.