The best time to prepare is now
Account recovery is easiest when you do the work before anything goes wrong. When a password is forgotten, a phone is lost or an attacker changes your details, the service needs a way to confirm that you are the rightful owner. Recovery options are those ways. If they are missing or out of date, even the real owner may be unable to get back in.
Setting them up takes minutes. Outcomes can never be guaranteed, but a well-prepared account is much less likely to be lost.
The main recovery options
A backup email address
A recovery email is a second address where the service can send a reset link or code. It should be:
- An account you control and use regularly
- Protected by its own strong, unique password and two-step sign-in
- Different from the account it protects, since a recovery address that is the same account would not help
Avoid addresses from a job you may leave or a school that may close your account. Some people keep a dedicated personal address for recovery only, a practice related to using email address aliases for different purposes.
A current phone number
A phone number allows the service to send a code by text or call. It is convenient, but it is not perfect. Numbers change, phones are lost, and SIM swap fraud can redirect messages to a criminal. Add the number, but do not make it your only option, and consider protections with your carrier.
Recovery or backup codes
Many services give you a set of one-time codes when you turn on two-step sign-in. Each works once and bypasses the usual second step. They are one of the most reliable ways back in when a phone is gone, which is why they matter for recovering an account when you lose your phone.
Store them carefully:
- Print them and keep the page somewhere safe at home, or save them in a password manager’s secure notes.
- Do not leave them in an unprotected note on your phone, in the same email account they protect, or in a screenshot in a shared photo stream.
- If you generate a new set, the old one usually stops working, so replace your stored copy.
More than one second step
If the service allows it, register more than one method: an authenticator app on your phone, a security key kept at home, and codes on paper. Passkey basics are also worth learning, because passkeys can sync across devices and ease sign-in. Compare your verification code options and aim for at least two that do not depend on the same device.
Trusted contacts and legacy contacts
Some services let you name a trusted person who can help in recovery or access an account after your death. If your provider offers this, think carefully about whom to choose and what they could see.
Which accounts first
You cannot fix everything on one afternoon, so begin with the accounts that unlock others:
- Your main email account
- Your phone carrier and Apple, Google or similar device-account
- Your password manager
- Banking and payment accounts
- Cloud storage with irreplaceable photos and documents
- Social media accounts you rely on
Email comes first because most other resets pass through it.
A short setup routine
Set aside thirty minutes and, for each priority account:
- Open the security or sign-in settings.
- Confirm the recovery email and phone number are correct and yours.
- Add a second recovery method if available.
- Download or generate backup codes and store them safely.
- Review which devices are signed in and remove old ones.
- Test that you can sign in with the recovery path where it is safe to do so, or at least confirm that a reset message arrives.
Keep it current
Recovery information goes stale. Calendar a quick check once or twice a year, and update immediately when you:
- Change phone numbers or carriers
- Close an old email account
- Replace or reset your phone
- Move or change jobs
People are often surprised to find an old address listed that they can no longer reach, which is how many accounts are lost.
Avoid common mistakes
- Using the same recovery address everywhere without protecting it. One weak spot unlocks many accounts.
- Answering security questions truthfully. Real answers can often be found online. If a service still requires them, consider the points in why security questions are weak.
- Assuming a phone backup will always exist. A lost phone can take authenticator codes with it unless you planned for that.
- Keeping the only copy in one place. A single piece of paper can be lost; keep a second copy in a different safe place.
Prepared accounts are calmer to recover
Having these details in place does not prevent every problem, but it changes how a bad day feels. When someone later asks for proof of ownership, as described in the process of how account lockout recovery works, the information you set up in advance is often exactly what it checks.