Hello, I’ve done some reading online but can’t find much info regarding this worst-case-scenario. Suppose someone’s device is working just fine, with Cloud Backup turned on.
1. What would happen if a scammer had the email and password and logged into their device to restore codes?
2. If Cloud Backup is turned off, is one screwed if their device is broken when trying to put codes on a new device?
You can use Microsoft authenticator in 2 phones. If You have a chromebook you can use the app in chromebook as a backup. Turn off cloud backup. You can Just Turn on momentanly to sync between phone and chromebook, then Turn off cloud in both devices.