Recovering an Online Account Starts Before You Lose Access

Keep recovery details current

An account recovery email or phone number that you no longer control can turn a forgotten password into a permanent lockout. Review recovery settings for your primary email and other essential accounts while you can still sign in. Use an address you check and a phone number that is not about to be cancelled. If the service offers recovery contacts, understand what those people can and cannot do.

Prepare a backup route

Save one-time recovery codes in a secure offline place, such as a protected password vault with an independent recovery path or a sealed paper copy. Do not keep the only copy inside the account the codes are meant to recover. Add a second authentication method where supported and remove old devices you no longer own. Test the official recovery instructions before an emergency rather than improvising under pressure.

Beware recovery impostors

Scammers may claim they can restore an account for a fee or ask you to share a verification code. Use only the service's official recovery page, reached by typing its known address or opening its genuine app. A support agent should not need your password or one-time code. If you regain access after a compromise, change credentials, review forwarding rules and sessions, and secure any linked accounts.

Sources and further reading

• Google Account Help: Recovery options
• CISA: Turn On MFA