An authorization credential migration method, comprising: sending, by a first terminal device, an authorization credential immigration request for a trusted application to a service server, wherein the authorization credential immigration request is sent by the first terminal device over a secure channel in a trusted execution environment, the authorization credential immigration request comprises a device identifier of the first terminal device, a secure element identifier of the first terminal device, an application identifier of the trusted application, and personal information of a user, and the first terminal device is a device into which an authorization credential is to be immigrated; receiving, by the first terminal device, a second authorization verification code of the trusted application that is entered by the user on a trusted user interface, wherein the second authorization verification code is entered by the user after the user views a first authorization verification code displayed on a second terminal device, wherein a mapping relationship between a device identifier of the second terminal device and an authorization credential of the trusted application is stored in the service server; sending, by the first terminal device to the service server, the second authorization verification code entered by the user, to instruct the service server to perform first authorization authentication; and receiving, by the first terminal device, the authorization credential of the trusted application that is sent by the service server, wherein the authorization credential of the trusted application is sent by the service server after the service server deletes the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application and sets up a mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application. sending, by a first terminal device, an authorization credential immigration request for a trusted application to a service server, wherein the authorization credential immigration request is sent by the first terminal device over a secure channel in a trusted execution environment, the authorization credential immigration request comprises a device identifier of the first terminal device, a secure element identifier of the first terminal device, an application identifier of the trusted application, and personal information of a user, and the first terminal device is a device into which an authorization credential is to be immigrated; receiving, by the first terminal device, a second authorization verification code of the trusted application that is entered by the user on a trusted user interface, wherein the second authorization verification code is entered by the user after the user views a first authorization verification code displayed on a second terminal device, wherein a mapping relationship between a device identifier of the second terminal device and an authorization credential of the trusted application is stored in the service server; sending, by the first terminal device to the service server, the second authorization verification code entered by the user, to instruct the service server to perform first authorization authentication; and receiving, by the first terminal device, the authorization credential of the trusted application that is sent by the service server, wherein the authorization credential of the trusted application is sent by the service server after the service server deletes the mapping relationship between the device identifier of the second terminal device and the authorization credential of the trusted application and sets up a mapping relationship between the device identifier of the first terminal device and the authorization credential of the trusted application.