Why recovery matters before you need it
Sooner or later almost everyone forgets a password, loses a phone or gets locked out. Recovery options are the safety net: the extra details you give a service so it can confirm you are really you and let you back in.
Setting them up is dull, which is why people skip it. But the moment you need them is the worst time to discover they are missing or out of date. A recovery route that works can turn a crisis into a minor annoyance.
There is a second side to this. Recovery options are also a way in. If someone can pass the recovery steps for your account, they may not need your password at all. So good recovery settings must be both usable by you and hard for others to abuse.
The common recovery options
Backup email address. A second address where a reset link can be sent. It should be one you control and check, and it should itself be well protected. A neglected old address you no longer use is a weak point, since a reset sent there could be read by someone else if the address was closed and later reassigned, or its password was compromised.
Phone number. Many services text a code to your phone. This is convenient, but numbers can change, and phone accounts can sometimes be targeted. Keep your number current and protect your mobile account with a PIN if your carrier offers one.
Recovery codes. Some services provide a set of single-use codes to print or save. They are meant for the moment when your usual second step is unavailable. They are valuable and should be treated like cash.
Security questions. Questions like a mother’s maiden name or a first school are often guessable from public information. If a service forces you to use them, a common suggestion is to answer with a made-up, unrelated phrase and store it securely, instead of the true answer.
Trusted contacts or devices. Some systems let you nominate a person or a signed-in device to help you regain access. These can be useful, but think about whom you trust and review the list occasionally.
A safe setup, step by step
- Start with your main email. Most other accounts send resets there, so protect it first with a long, unique password and a second verification step. The article on two-step verification explains the options.
- Add a backup email and phone number. Use details you will keep for a long time. Avoid a work address you might lose when you change jobs.
- Generate recovery codes where offered. Store them away from the device they protect.
- Update security questions. If you must have them, use unrelated answers recorded securely.
- Check which devices are signed in. Remove ones you no longer use or recognize.
- Write down how recovery works for your most important accounts, in a private place, so you are not working it out under pressure.
Storing recovery information
Where you keep the codes matters as much as having them.
- Do not keep them in the same place as the secret they back up. A code saved in an email inbox that you are locked out of is not much help.
- Do not leave them in an unprotected note on your phone or in a shared document.
- Consider printing them and keeping the paper in a secure place at home, such as a locked drawer, or saving them in a reputable password manager. If you are using a manager, the explanation of how password managers work covers vault storage.
- Tell a trusted person where emergency information is stored, especially for accounts that a family would need to reach if something happened to you.
If you ever suspect a code has been seen by someone else, replace it. Many services let you generate a fresh set that cancels the old one.
Keeping details current
Recovery options go stale. People change phone numbers, close old email accounts and move house. Put a reminder in your calendar once or twice a year to check them for your most important accounts. This pairs well with a broader privacy checkup, and if you are closing accounts as part of tidying up, make sure none of your active accounts relies on an address you are about to delete.
When you replace a phone, update the number and move any authenticator apps before wiping the old device. Our article on lost phone steps covers what to do if you lose one unexpectedly.
Recovery and scams
Scammers sometimes pose as support staff and ask for a recovery code or a text message code, claiming they need it to “verify” you or “stop” a problem. A legitimate service will not ask you to read out a one-time code. If someone does, it is a warning sign, and the section on online scams explains what the usual patterns look like.
Also be cautious about unexpected recovery messages. If you receive a reset email or text that you did not request, do not click anything in it. It may mean someone is trying to get into your account, and it is worth reading about the signs of account takeover. Go to the service directly, using an address you type yourself or an official app.
If you are already locked out
Use the service’s official recovery page. Expect to answer questions, wait through a delay or provide details such as the device you usually use. Be honest and patient, and avoid third-party “recovery services” that appear in search results or social media, which are often scams. Recovery can take days, and outcomes vary by service.
A few minutes of preparation now can save a great deal of trouble later.