Recovering access to an account

Protection

A forgotten password, a lost phone, a changed number. What to prepare while you still have access and what to do once you do not.

People think about account recovery at precisely the moment it no longer works. The password is forgotten, the phone drowned, the number changed three years ago — and it turns out every fallback leads nowhere.

What to prepare while you still have access

  1. Backup codes

    Issued when you enable a second factor, and they work when you have neither phone nor app. Save them in your password manager and print a copy.

  2. A spare email address

    Not a work one and not one you abandoned. Set up a separate mailbox and sign in twice a year — some services delete inactive addresses.

  3. An up-to-date phone number

    The thing that goes stale most often. Changed your number? Walk through the important services that month, not when you need them.

  4. A second device with the authenticator

    A tablet or an old phone at home. One device is one point of failure.

  5. An actual test

    Once a year, try signing in with a backup code. An untested recovery path is a hope, not a path.

What to do depending on what is lost

What is lostWhat remainsFirst step
Only the passwordEmail, phone, second factorOrdinary recovery by email link
The phone with the authenticatorBackup codes, trusted devicesSign in with a code and re-enrol the second factor
Access to emailPhone and spare addressRecover the mailbox first — it opens everything else
The phone numberEmail and appChange the number in services while the old one still works
Everything at onceA trusted computer with an open sessionDo not sign out of it and recover from there
Recovery procedures and identity requirements vary between services — check the help pages of the one you need.

If nothing is left

  1. The recovery form, not a letter to support

    Large services have a dedicated form for the “no access to anything” case. It asks about the contents of the account: dates, contacts, previous passwords.

  2. Answer from your usual device and network

    A request from the same computer and the same connection is treated more favourably: it is one more sign that you are you.

  3. Do not create a new account instead of the old one

    While recovery is under way it muddies the picture. And do not give up after the first refusal: a second request with more precise answers often succeeds.

Copied