Set up account recovery before you need it

Almost everyone sets up strong security and never tests the way back in. Then a phone is lost, or a number changes, or an authenticator app is wiped in a handset upgrade, and it turns out the recovery email is one they stopped using in 2014.

Locked out of your own email is a genuinely bad week. This is an hour that prevents it.

Start with email

Everything else resets through it, so it gets done first and properly.

• A recovery email address at a different provider. A Gmail account whose recovery address is

another Gmail is one outage from useless.

• A current phone number, and see the trap below.
• Download the recovery codes and put them somewhere physical. Printed, in a drawer. Not a file

on the laptop you might be locked out of.

• Check what is already listed. Most people have never looked, and find an address or number they

lost years ago.

The phone number trap

Two ways this bites:

You change number and forget to update it. Now recovery goes to a stranger.

You rely on SMS codes and lose the SIM. A stolen or cancelled SIM takes your codes with it — see what to do when your phone is stolen.

Use an authenticator app rather than SMS where you can, and keep the number updated anyway, because many services still use it as a last resort.

Moving your authenticator app

The most common self-inflicted lockout there is. People replace a phone, factory reset the old one, and discover the codes did not come with it.

• Use one that syncs — Google Authenticator, 1Password, Authy, Proton Pass. Older versions of

Google Authenticator did not, which is where the horror stories come from.

• Export before you wipe the old phone, not after.
• Keep the old phone until the new one works, including a test sign-in to something important.

Recovery codes, stored properly

Every service that offers two-factor gives you a set of one-time codes. Almost nobody keeps them.

Good places: printed and in a drawer, or in a password manager you can reach from another device.

Bad places: a screenshot in your camera roll that syncs to the cloud account you are trying to recover, or a note on the phone in question.

Trusted contacts, where offered

Apple has Account Recovery Contacts, Facebook has something similar. A person you trust can help you prove who you are. Set one up, tell them, and check they still have the same account in a year.

Test it, once

The step everyone skips. Pick a Saturday morning:

1. Sign out of your email on a device you do not normally use. 2. Sign back in. Notice which method it asks for. 3. Then try the recovery path deliberately: "try another way", and see whether the options listed are ones you can actually use today.

If the answer is a phone number you no longer have, you have just avoided a bad week for the cost of ten minutes.

For an older relative

Do this with them, and keep a copy of the recovery codes yourself with their agreement. When they are locked out, they will ring you, and you want to be able to help rather than starting from nothing.