Browsers & Accounts · How Accounts Get Stolen · Lesson 3 of 5

Account Recovery Done Right

Recovery email, phone and backup codes, and the scams that fake recovery.

Your spare keys

Account recovery is how you get back into an account when you forget the password or lose your phone. Set it up before you need it. After a lockout, it is often too late.

Most big accounts offer a few kinds of spare key.

• A recovery email is a second email address. The site sends reset links there.
• A recovery phone is a number that can get a code by text or call.
• Backup codes are one-time codes you save ahead of time. Each one gets you past two-step once, even without your phone. Google, for example, gives a set of 10. Making a new set cancels the old one.
• A trusted contact is a person you pick who can help confirm it's you, where the service offers it. Apple calls this a Recovery Contact.

Spare keys only work if they are current. An old school email you can't open, or a phone number you gave up years ago, is worse than useless. Someone else may now own that number or address. They could use it to reset your account.

So check your recovery settings about once a year, and whenever you change phones or email.

Store backup codes like a spare house key. Good places are a password manager, or a printed copy in a drawer at home. Don't keep them only on the phone you might lose, and don't share a photo of them.

Remember, recovery details are also a door. Anyone who changes them can lock you out. So a "recovery email changed" alert you didn't expect is serious. Act on it right away.

On the practice computer, open the recovery settings. Update the old recovery email, add a phone, download your backup codes and store them safely. Then use a backup code to get in when you're locked out.

The "we'll get it back for you" scam

Losing an account feels awful. Criminals know this, and they wait for it. A recovery scam is when someone offers to get your account back, for a fee.

It often looks like this.

• You post "my account got hacked, help". Within minutes, strangers reply or message you.
• They claim to be a "recovery expert", an ethical hacker, or someone who "knows a person at" the company.
• Some pretend to be the company's support team, with a logo and a serious name.
• They ask for money first, often by gift card, crypto or a payment app. Then they ask for more. Some also ask for your password or codes, which hands them your other accounts.

Here are the facts. Big services like Google, Apple, Microsoft, Meta and game platforms do not charge to recover your account. Their real recovery forms are free and live on their own websites. Support staff will not message you first on social media to offer help.

The US Federal Trade Commission gives simple advice for any recovery offer. Don't pay someone who contacts you out of the blue and promises to recover something for an upfront fee.

To recover safely:

1. Type the service's address yourself, or use its official app.
2. Look for a link like "Forgot password" or "Can't sign in".
3. Follow the steps there. Use a device and place you often sign in from, since that helps prove it's you.
4. Be patient. Some recoveries take days.

If you already paid someone, stop paying and report it. You'll see how in the next module.