What happens if I lose my phone?

Tell your administrator, who revokes that device's key in one action — the phone immediately stops being able to sign you in, with no waiting for tokens to expire. Whoever found the phone can't use it to be you anyway: sign-in requires your live face, which is checked for liveness, not just a picture of you.

You re-establish access on a replacement device by presenting your face — there is no recovery password that a helpdesk could be talked into handing over.