Map the dependencies, not your secrets
Account recovery often depends on something outside the account: an email inbox, a phone number, a trusted device or a backup code. Write down which recovery methods your important accounts use, but keep actual passwords and codes out of an ordinary checklist. The aim is to notice weak links, not create a convenient collection of secrets for someone else to find.
Look for circular dependencies. Your email may require a code from an authenticator on your phone, while restoring that phone’s backup requires signing into the same email. A password manager may contain the email password, while recovering the manager requires access to that inbox. These arrangements can work while everything is available and fail when one device disappears.
Prepare an independent recovery route
Check each important provider’s official recovery options. A spare registered security key, provider-issued backup codes or a carefully protected recovery contact may offer a route that does not depend on your everyday phone. Availability varies. Adding a second method also creates another item to secure, so choose options you can maintain rather than enabling everything without understanding it.
Store backup codes somewhere access-controlled and separate from the account or device they unlock. A paper copy in secure physical storage avoids some digital dependencies but introduces risks from theft, fire or loss. An encrypted digital copy may be easier to duplicate but requires a working decryption route. Consider both confidentiality and availability. Replace used codes according to the provider’s instructions, and remove obsolete copies when a new set invalidates the old one.
Keep recovery addresses and numbers current, especially before changing a phone number, leaving an employer or closing an email account. Secure the recovery inbox as carefully as the primary account. If a service allows trusted contacts, discuss the responsibility first and read what powers that role actually grants. Do not assume every provider’s recovery-contact feature works the same way.
Separate file backups from account recovery
Restoring account access does not necessarily restore deleted files, and a file backup does not necessarily let you sign in. Keep more than one appropriate copy of important data, with at least one protected from the same failure that could affect the original. An always-connected drive or ordinary sync folder may reproduce accidental deletion or ransomware changes rather than preserve a clean version.
Check whether your backup service offers version history, how long previous versions remain and what happens if its subscription or linked account becomes unavailable. Protect backup access with strong authentication. Test restoring a small, non-sensitive sample to a safe location. A successful backup notification is useful, but a restore test gives better evidence that the process works for your situation.
Use a calm response path
If a device goes missing, use the manufacturer’s official lost-device guidance from a trusted device. Consider remote locking, carrier contact and session revocation as appropriate. A remote erase may have consequences for tracking or recovery, so read the provider’s explanation before choosing it. If the device belongs to an employer, report it through the organization’s process promptly.
I am replacing a phone
Keep the old device available until you have checked authenticator migration, passkey availability, password-manager access and important recovery destinations. Verify the new device can sign in before erasing the old one. Follow the device maker’s reset instructions before transfer or disposal.
I am already locked out
Open the provider’s official recovery process from a known address. Use an existing trusted device if available, follow the stated waiting periods and avoid repeated speculative changes. Recovery is not guaranteed. Do not pay strangers who claim they can bypass the provider’s checks.
I suspect someone else has access
Use a device you reasonably trust. Follow the provider’s compromised-account procedure, secure the recovery inbox, change exposed credentials and review active sessions, forwarding rules, connected applications and recovery methods. Contact your financial institution promptly if payment information is involved.
Keep a small personal review routine
A useful checklist asks whether your arrangements still match your life. Have you changed a phone number? Is a former housemate still a recovery contact? Do you still possess both security keys? Are backups completing and restorable? Review after meaningful changes rather than treating a completed checklist as a permanent safety certificate.
Share process instructions with a trusted person when appropriate, without casually handing over credentials. For households, discuss how to verify urgent requests and where to find provider support information. For businesses, use documented access and succession procedures rather than putting all authority in one person’s private account. Accessibility needs and realistic technical confidence should shape the plan.
Keep expectations clear: providers may impose delays, require evidence or decline recovery if they cannot establish ownership. Strong protections can make unauthorized access harder while also making forgotten credentials harder to recover. That trade-off is why preparation matters. Our site cannot unlock accounts, verify ownership or guarantee restoration.
Use current instructions from Google Account recovery, Apple account recovery or Microsoft account support where relevant. For general preparation, the National Cyber Security Centre’s online safety collection provides further context.