One scam app even captures your QR codes. You don’t have to look very hard for it: The developer took out an App Store ad, which means it is prominently shown when you search for authenticator apps.

In terms of data the apps collect, Mysk says Google’s Authenticator performs “very well” and doesn’t share details of QR codes with Google. “Most apps, including Microsoft Authenticator ...

If your authenticator app doesn’t have any backup or syncing features, you can make the change manually: Visit each site that you have a 2FA code for, log in using your old phone, deactivate 2FA ...