Account recovery: how to plan it before you need it

Account recovery is the route back in when you lose your password, your phone or your second factor. It only works if you prepared it while you still had access. Plan for three things: a current way to reach you, one or more fallback codes or keys, and a person or document that helps if everything else fails.

Why recovery deserves attention

Passkeys, 2FA and a password manager protect the front door. Recovery is the side door. If it is easy to open for you, it may also be easy to open for someone else, and if it is broken, you can lose accounts, photos and money. A good setup is a balance: recoverable by you, hard for others.

The recovery building blocks

Building block	What it does	Watch out for
Recovery email	A second inbox that can receive reset links	It must be secured as well as your main email
Recovery phone number	Receives codes or confirms it is you	Numbers change, and SMS can be hijacked (see SIM swapping)
Backup codes	One-time codes that replace your second factor	Store them offline, not in the account they protect
Recovery key	A long secret that replaces standard recovery	If you lose it and your trusted devices, you may be locked out for good
Recovery contact	A trusted person who can vouch for you	Pick someone reachable who understands what you ask of them
Second device or passkey	Another signed-in device, or a second passkey	Keep at least two

Provider specifics

Google. You can keep a recovery email and phone number, generate a set of 10 backup codes and, in newer account settings, add recovery contacts. Google describes the options in its help pages on backup codes and recovery contacts.

Apple. Apple offers a recovery contact, a Legacy Contact and an optional 28-character recovery key. Apple’s recovery key article explains that using a key replaces Apple’s standard recovery, so the responsibility for keeping it moves to you.

Other services. Most big providers offer a mix of the same items. Look for “recovery”, “security” or “sign-in options” in the account settings.

Step by step: set up recovery in 20 minutes

1. Pick your three key accounts. Main email, Apple or Google account, password manager.
2. Update recovery details. Check that the recovery email and phone number still work. Remove old ones.
3. Add a stronger method than SMS. Use an authenticator app, a security key or a passkey where possible.
4. Generate backup codes. Print them or store them somewhere that does not depend on the account they protect.
5. Name a recovery or legacy contact if the provider offers it.
6. Write a short recovery sheet. List which accounts exist and where each recovery item is kept. Do not write passwords on it. Keep it in a safe place.
7. Test it. Sign in on a second device, or follow a recovery flow up to the confirmation step, so you know what to expect.

Do not make recovery the weak link

Attackers often skip your password and ask the provider to “recover” the account. To stay ahead:

• Do not rely on SMS alone for important accounts.
• Treat any unexpected recovery email or code as a warning sign and change your password through the official site, not a link.
• Keep your email secure, since many resets are sent there. Our guide to securing your email account shows how.
• Never give a recovery code or backup code to anyone who contacts you. Providers do not ask for them.

If you are already locked out

Use the provider’s official recovery page, from a device and location you have used before, and answer as precisely as you can. Expect delays. Cut the process short only by using the documented steps. Avoid third-party “recovery services”, which are a common scam.

Recovery for different kinds of accounts

Not every account needs the same effort. A simple way to decide is to sort your accounts by how much damage a lockout would cause.

Tier	Examples	Recovery effort
Critical	Main email, Apple or Google account, password manager, banking	Several independent recovery items, offline copy, trusted contact
Important	Cloud storage, work tools, social media with a large audience	Backup codes and a current recovery email
Everyday	Shops, forums, newsletters	A password in your manager is enough, recovery runs through your email

Phones, numbers and devices

A new phone is the moment most people lose access. Before you switch, move your authenticator app accounts with the vendor’s transfer feature, check that passkeys sync to the new device and keep the old phone until everything works. If your number changes, update it on every account that uses it for recovery. Do not let a number lapse, because carriers recycle old numbers, and a new owner could receive your reset codes.

What providers can and cannot do

Providers protect you by being strict. A support agent usually cannot simply hand over an account because you describe it well. This is why the options you set up yourself matter so much, and why a plan made in advance beats a plea afterwards.

Keep it current

Put a yearly reminder in your calendar: check recovery email and phone, count remaining backup codes and confirm that your trusted contact is still the right person. Five minutes a year keeps the whole setup alive.

Bottom line

Recovery is boring until the day it matters. A short setup session, a few offline codes and one trusted contact turn a possible disaster into a delay.