Getting back in: recovery phone, recovery email, contacts and codes

Check the recovery phone and recovery email on your main accounts, add a recovery contact, and print any recovery code, before you change a single password.

1. Why recovery comes first Understand

Account recovery is the process a company uses to let you back into an account when the usual sign-in fails: you forgot the password, you lost the phone that gets your codes, or someone else changed the password. Each company's process leans on information you gave it beforehand. That information is what this chapter checks.

The order matters. Google's help page on recovery options says you can't add recovery info while you are locked out of your account or partway through recovering it (Google Account Help, Set up recovery options). Product-specific So this manual checks recovery before Passwords changes any password and before Two-step sign-in and passkeys adds two-step sign-in. Both of those changes make a forgotten password or a lost phone more serious. Recovery information is what lets you undo either one.

Start with the main email you marked in Your starting list. Whoever controls it can ask other accounts for password reset links, as the FTC's page on hacked email explains (FTC, How To Recover Your Hacked Email or Social Media Account). Then check the account your phone, tablet or computer signs in with: the Apple Account, the Google Account or the Microsoft account. If your main email is that same account (Gmail on an Android phone, iCloud Mail on an iPhone, Outlook.com on a Windows computer), one check covers both. Bank, card and phone company accounts have their own recovery rules; Passwords, Two-step sign-in and passkeys and Money and identity reach them. Our convention

The kinds of recovery information

The providers use different names for similar things. These are the terms this manual uses:

• A recovery phone is a phone number on the account where the company can send a code to prove it is you. Apple calls the same idea a trusted phone number: the number where Apple sends sign-in codes.
• A recovery email is a second email address on the account, in a different account, where the company can send a code or a warning. Yahoo and AOL call it an alternate email. Microsoft calls its list of phone numbers, email addresses and apps your security info.
• A recovery contact is a person you name on your account who can help you prove it is you, usually by passing you a code. Google and Apple offer this.
• A recovery code is a long code the company gives you once, to print and keep, that proves the account is yours when other methods fail. Google calls its set of printed codes backup codes.
• A trusted device, in Apple's terms, is an iPhone, iPad, Mac or other Apple device already signed in to your account, where Apple can show a sign-in code.

What makes recovery info work

Recovery information works only if it reaches you on the day you need it. Google's page states the test for a recovery phone: a mobile phone that gets text messages, belongs only to you, and that you use regularly and keep with you. It also says not to use a Google Voice number, because the code you need to get back in would go to the Google Voice account you cannot open. Product-specific A landline you gave up years ago fails every part of that test. So does a phone number that belongs to a helper rather than to you.

For a recovery email, Google asks for an address you use regularly but not the one you sign in with. That second address has to be in a different account, with its own password, that you can open today. The test is simple: sign in to it. If you cannot, it will not help you later. Test it

Out-of-date recovery information is the common way people lose an account for good. AOL's sign-in help says that if your recovery phone and alternate email are wrong or out of reach, you might not be able to get back into your account (AOL Help, Fix problems signing into your AOL account). Yahoo's page says the same about its Sign-in Helper (Yahoo Help, Fix problems signing into your Yahoo account). Product-specific

Microsoft is moving away from phone numbers. Its security info page says the option to add a new phone number may not be available for your account, and that Microsoft will phase out text messages for sign-in and account recovery on personal accounts (Microsoft Support, Microsoft account security info and verification codes). For a Microsoft account, a second email address and the printed recovery code carry more of the weight. Product-specific

If two people share one email address, as some households do (Your starting list covers the tradeoffs), the recovery phone belongs to one of them. Who holds it is the household's decision.

Changes take time to take effect

Providers deliberately slow down changes to recovery information. Google says a new or changed recovery phone may take up to 7 days to take effect, and that Google may send codes to your previous recovery info for 7 days, so that if someone else changes it you can still stop them. Microsoft says that with two-step verification on, changes take 30 days to take effect, and that losing a contact method can mean 30 days before you regain access (Microsoft Support, How to get a Microsoft account recovery code; Microsoft Support, How to use two-step verification). Apple's account recovery wait can last several days or longer. Product-specific

The waits protect you from a stranger who gets your password. They also mean the time to fix recovery information is now, on an ordinary day, and not the week you need it.

2. Where each provider keeps it

Recovery settings belong to the account, not to the device. You can check them from any phone, tablet or computer where you can sign in, and the change applies everywhere. The device you hold decides only which account it signs in with.

Type each web address into the browser yourself. A search result or an ad can lead to a look-alike page or to a paid service that is not your provider. Section 4 explains why that matters for recovery in particular. Our convention

Gmail and other Google Accounts

These steps work in a web browser on any phone, tablet or computer. They are copied from Google's recovery options page.

1. Open a web browser and go to myaccount.google.com. Sign in if it asks.
2. Select Security & sign-in. Older guides call this tab Security.
3. Under How you sign in to Google, select Recovery phone. You may need to sign in again.
4. Read the number. If it is not the phone you have now, select Edit next to the number and follow the steps on the screen.
5. Go back and select Recovery email. Read the address. To change it, select Edit.
6. Go back and select Recovery contacts if you want to add a person (Google recovery contacts).

In short: Google Account > Security & sign-in > How you sign in to Google > Recovery phone, Recovery email, Recovery contacts.

If Google does not let you change recovery info, its page says to try again from a device and a place where you usually sign in, or the following week from the device you are using. Google also notes that not every recovery option is offered in every region or on every account, and that accounts run by a workplace or school may follow other rules. Product-specific

iCloud Mail and other Apple Accounts

An iCloud Mail address (icloud.com, me.com or mac.com) uses your Apple Account's recovery settings. On an iPhone or iPad:

1. Open Settings.
2. Tap your name at the top.
3. Tap Sign-In & Security.
4. Read the trusted phone numbers listed for two-factor authentication. Each should be a number you have now.
5. Tap Recovery Contacts if you want to add a person (Apple recovery contacts).

In short: Settings > [your name] > Sign-In & Security. On a Mac: open the Apple menu, choose System Settings, click your name, then click Sign-In & Security. In short: Apple menu > System Settings > [your name] > Sign-In & Security.

Apple says two-factor authentication is the default security method for most accounts, and that a new sign-in needs your password plus a six-digit code shown on a trusted device or sent to a trusted phone number (Apple Support, Two-factor authentication for Apple Account). If the only trusted phone number is the iPhone in your hand, losing that iPhone takes away both the device and the number. A second trusted number, such as another phone you keep, or a recovery contact, gives you another way back. Product-specific

Outlook.com, Hotmail and Live (Microsoft account)

These steps work in a web browser on any device, including a Windows computer. They are copied from Microsoft's security info page.

1. Open a web browser and go to account.microsoft.com/security. Sign in.
2. Select Manage how I sign in. The page lists the ways you can prove who you are.
3. Read each email address and phone number listed. Each should be one you can reach today.
4. To add one, select Add a new way to sign in or verify, then choose the kind.
5. Microsoft sends a code to the new address. Enter the code when asked, then select Next.

In short: account.microsoft.com/security > Manage how I sign in > Add a new way to sign in or verify.

Microsoft allows up to 10 methods: email addresses, an authenticator app and a passkey. Its page says an email address on the list does not have to be yours, and suggests a partner's or family member's address for emergencies. It also says to keep the list current: if you change a work or school address that is on the list, you may lose access. Microsoft recommends three pieces of security info on an account with two-step verification. Product-specific

Yahoo Mail

Yahoo's recovery tool is the Sign-in Helper: you enter your recovery mobile number or alternate email, and it lets you reset the password or find your Yahoo ID. Yahoo names the Yahoo Account security page as the place for sign-in settings, with a section called Ways of signing in.

1. In a web browser, sign in to the Yahoo Account security page.
2. Under Ways of signing in, read the phone numbers and email addresses listed.
3. To add one, click Add phone number or Add email and follow the prompts to verify it.

In short: Yahoo Account security page > Ways of signing in. Yahoo's screens can differ in its mobile apps; if yours does not match, follow Yahoo's own help for adding a recovery method. Product-specific

AOL Mail

AOL's steps are on its help page for recovery information (AOL Help, Add, replace or remove AOL account recovery info).

1. In a web browser, go to login.aol.com/myaccount/security. This is the AOL Account Security page. Sign in.
2. Scroll to the bottom of the page.
3. Read the recovery phone number and the alternate email listed.
4. To add one, click Add email or Add phone number, then follow the prompts to enter and verify it.
5. To replace one, add the new one first. Then click Remove next to the old one, and click Remove email or Remove phone to confirm.

In short: AOL Account Security page > Add email or Add phone number. Adding the new one before removing the old one keeps a way to reach you on the account throughout.

AOL's recovery tool is also called the Sign-in Helper, at login.aol.com/forgot. AOL's help pages end with a phone number for paid premium support. The Sign-in Helper is AOL's own recovery tool; we do not list the paid line. Product-specific

Email from your internet company or another provider

Many internet companies give an email address with the service, and smaller providers run their own. We did not check their recovery pages, and they differ from company to company, so we do not give a path. Do this instead:

1. Find the company's name. It is the part of your email address after the @, or the name on your internet bill.
2. Type the company's own web address into the browser yourself, sign in, and look for account or security settings that list a recovery phone and email.
3. If you cannot find them, call the company at the number printed on your bill.
4. Ask two questions: what recovery information is on the account, and how you would get back in if you forgot the password.
5. Write the answers on the recovery sheet, with the date and the name of the company.

Use the number on the bill rather than one from a search result, so you know whom you are calling. Ask your internet company

3. Recovery contacts and printed codes

A phone and an email are things you can lose. A person you trust and a code on paper are two backups that do not depend on either. This section covers both.

Google recovery contacts

Google's page says to choose a recovery contact you know well and trust, such as a family member or a close friend. You send the request to their email address. Google tells them your name, email address and profile photo.

1. In a web browser, go to myaccount.google.com and sign in.
2. Select Security & sign-in.
3. Under How you sign in to Google, select Recovery contacts. You may need to sign in again.
4. Select Add recovery contact.
5. Type the person's email address.
6. Select Send request.

In short: Google Account > Security & sign-in > How you sign in to Google > Recovery contacts > Add recovery contact.

The request lasts 7 days. After the person accepts, there is a further 7-day period before Google lets you use them for recovery. Google says recovery contacts do not get your security alerts. Tell the person before you send the request, so they recognize it and know what you are asking of them. Product-specific Our convention

Apple recovery contacts

Apple's page explains what a recovery contact can and cannot do (Apple Support, Set up a recovery contact for your Apple Account). During account recovery, they can get a six-digit code for you, or help you in person, and you enter that code on your own device to reset your password. Apple says they have no access to your account, only the ability to give you a code. Apple does not know who your recovery contacts are, so it asks you to remember. Writing the name on the recovery sheet does that.

Before you add one, Apple lists what both of you need:

• All of your Apple devices on iOS 15, iPadOS 15 or macOS Monterey 12 or later. Apple may ask you to remove an old device you no longer use.
• The recovery contact has an Apple device on iOS 15, iPadOS 15 or macOS Monterey 12 or later. So a person whose only phone is an Android phone does not meet Apple's requirement.
• iMessage turned on, for both of you.
• Both of you over the age of 13 (the age varies by country or region).

On an iPhone or iPad:

1. Open Settings.
2. Tap your name at the top.
3. Tap Sign-In & Security.
4. Tap Recovery Contacts.
5. Tap Add Recovery Contact and follow the steps on the screen.
6. Choose one of the people suggested, or tap Choose Someone Else.

In short: Settings > [your name] > Sign-In & Security > Recovery Contacts > Add Recovery Contact. On a Mac the path is the same from Apple menu > System Settings > [your name] > Sign-In & Security > Recovery Contacts.

Someone in your Family Sharing group is added at once. Anyone else gets an invitation in the Messages app and has to accept it; you see a message when they have. You can add up to five. If someone later removes themself, Apple notifies you so you can choose another. Without a recovery contact you can still go through Apple's full account recovery, which Apple says can take longer. Product-specific

Microsoft: a family member's email instead

The Microsoft pages we read do not offer a recovery contact feature. They offer something close: an email address on your security info that belongs to a partner or family member, which Microsoft suggests for emergencies. Microsoft says it sends codes to the email addresses listed on your account. So whoever reads that inbox can receive a code for your account. Choose that person the way you would choose a recovery contact, and tell them what the codes are for. Our convention

Choosing a person

No provider can tell you whom to trust, and neither can we. Some practical tests help:

• You know them well, as both Google and Apple ask. Product-specific
• They will still be reachable in five years: a phone number and an email address that are unlikely to change. Our convention
• For Apple, they have an Apple device on a recent system. For Google, an email address they check.
• They know they have the role, and what to do if you call: pass on the code, and nothing else.
• They do not live with you, if the reason you want a backup is a lost or stolen phone in your home. A second person in another place covers a fire or a burglary that takes both your phones. Preference

NIST, the US standards body, lists a prearranged recovery contact as one recognized way to recover an account, alongside saved recovery codes (NIST SP 800-63B-4, Digital Identity Guidelines). Its rules are written for the companies that run accounts, not for you, but they show that a person is a normal part of recovery, not a workaround. Write each person on the people I trust with a role sheet, with how to reach them and whether they know.

Printed recovery codes

Microsoft's recovery code is a 25-character code (Microsoft calls it a 25-digit code) that helps you back in if you forget your password or someone takes over the account. Microsoft says to print it and keep it in a safe place, and not to store it on a device you use to sign in.

1. In a web browser, go to account.live.com/proofs/manage/additional and sign in. This is Microsoft's Manage how I sign in page.
2. Scroll down to Recovery code.
3. Select Generate a new code.
4. Print the code, or write it on paper by hand.
5. Put the paper with your important papers, and write where it is on the recovery sheet.

In short: account.live.com/proofs/manage/additional > Recovery code > Generate a new code. As soon as you make a new code, any earlier code stops working. Microsoft cannot show or download an existing code again: if you lose the paper and can still sign in, make a new one. To use it when locked out, Microsoft's page gives the path: sign in with your username, select Other ways to sign in, then Use my password, then Forgot password?, then Use a different verification option, then I don't have any of these, and enter the code. It is not case-sensitive and needs no spaces or dashes. Product-specific

Google's printed codes are called backup codes: a set of 10, each 8 digits, each usable once. They appear only once two-step sign-in is on, so they come in Two-step sign-in and passkeys. Yahoo's and AOL's help pages we read do not offer a printed code. Apple's printed option, the recovery key, is a different kind of thing; see the Limits box below.

Where a printed code lives

Every source we read that discusses a printed code puts it on paper, away from the devices it protects. NIST says saved recovery codes are meant to be kept offline, printed or written down, and stored securely. Google says to keep backup codes where you keep your passport or other important documents. Microsoft says not to keep the code on a device you sign in with. Apple says not to keep its recovery key in the Passwords app, iCloud Photos, Notes or iCloud Drive, because if you lose access to your account you will not be able to open those apps to find it. Product-specific

This manual rule follows from that: the code goes on paper, with your important papers, and the recovery sheet records only the place, such as "passport folder, desk." Do not type the code itself into the sheet or into any field in this manual. Our convention

4. What getting back in is like

Knowing what each company's process looks like does two things. It tells you what the settings you just checked will be used for. And it makes a fake "recovery service" easier to recognize, because the real processes are free and run on the provider's own pages.

Google

Google's recovery starts on its own account recovery page. Google's tips (Google Account Help, Tips to complete account recovery steps) say:

• Answer as many questions as you can. If you are unsure, take your best guess. Wrong guesses won't kick you out of the process, and Google's main recovery page says there is no limit to the number of attempts (Google Account Help, How to recover your Google Account or Gmail).
• Use a phone, tablet or computer where you often sign in, the browser you usually use, and a place where you usually sign in, such as home.
• If asked for a password, give the most recent one you remember.
• Only enter your password or codes at accounts.google.com.

If recovery fails, Google says a recent change to recovery info may take up to 7 days to take effect, so try again in a few days. As a last step it suggests making a new account. Product-specific

Apple

Apple's account recovery is for when you cannot reset the password any other way. Apple's page sets out what happens (Apple Support, What to expect during account recovery):

• Within 72 hours you get an email (or an iMessage, for accounts that use only a phone number) with the date and time you can expect to get back in.
• The wait might take several days or longer. Apple Support can't shorten it; Apple says the waiting period is fixed.
• Do not submit a second request. Apple says it will not speed things up and might extend the wait.
• If you started recovery on the web, turn off your Apple devices during the wait: using a device signed in to the account cancels the request. If you started it on a device with iOS 17 or later, you can keep using that device.
• Check the status at iforgot.apple.com, with the same email and phone number you used to start.
• If you get a recovery email you did not ask for, someone may be trying to get into your account. Use the cancel link in that email right away.

A recovery contact shortens part of this: Apple says recovery without one can take longer. Product-specific

Microsoft

Microsoft sends people who cannot sign in to its sign-in helper tool, and the recovery code is the way in when no listed method is in reach. With two-step verification on, Microsoft says changes take 30 days to take effect. Microsoft's pages also say its support agents are not allowed to send password reset links, or access and change account details. So a person who calls you, says they are from Microsoft and offers to reset your password is not following Microsoft's own rules. Product-specific

Yahoo and AOL

Both use a Sign-in Helper: login.yahoo.com/forgot for Yahoo and login.aol.com/forgot for AOL. You enter the recovery phone or alternate email and follow the steps. If you sign in from a new device or place, both may show a "First time signing in here?" message and send a code to the recovery phone or email. Too many wrong passwords lock the account for a while. Yahoo says its lock ends by itself after 12 hours, or you can use the Sign-in Helper at once. AOL says the wait varies, and to use the Sign-in Helper rather than keep guessing. Product-specific

Facebook

Facebook is not an email account, but it is one people often lose. Facebook's help page sends you to facebook.com/hacked, used from a device you have logged in from before, and has a separate route for when you cannot reach the account's email or phone (Facebook Help Center, Recover a Hacked Account). Product-specific

Nobody legitimate charges to recover an account

The providers say this directly. Google's page states: "You can't call Google for help to sign into your account." It adds that Google does not work with any service that claims to provide account or password support, and tells you not to give out your passwords or codes. Google's tips say Google never asks for your password or verification codes by email, phone call or message, and its backup codes page says Google asks for a backup code only when you sign in. Microsoft's agents, as above, cannot send reset links. Product-specific

The FTC describes the pattern from the other side. Its page on recovery scams says scammers contact people who have already lost something and offer to get it back for an upfront fee, and that agencies and legitimate groups never charge for that help (FTC, Refund and Recovery Scams). An FTC alert from August 2026 puts it in five words: "Anyone who does is a scammer" (FTC consumer alert, Watch for scammers who say they can help). The FTC pages are about recovering money; the same sign, a fee or a request for a code, marks a fake account recovery offer.

5. See it See it

Free pages that show each process in the provider's own words:

• Google Account Help, Set up recovery options: every Google recovery method, with the 7-day notes.
• Apple Support, Set up a recovery contact: what a recovery contact can do and what both people need.
• Microsoft Support, How to get a recovery code: making, printing and using the 25-character code.
• AOL Help, Add, replace or remove recovery info: the AOL Account Security page steps.

6. Practice Practice

Minimum: the main email's recovery phone and recovery email read, fixed if wrong, and written on the recovery sheet with today's date. Time: about 20 minutes for the main email; about 30 minutes with the device account, a recovery contact and a printed code. Materials: the phone, tablet or computer you usually sign in on; the main email's password, from wherever you keep it; a pen; and the recovery sheet, open in this browser or printed. The recovery sheet is essential on a first pass.

1. Open the recovery sheet. Find the row for your main email, or add one.
2. Open the recovery settings for the main email, using the path in section 2 or the green box below.
3. Read the recovery phone. Is it the phone you have now, and does it get texts? On the sheet, write only its last four digits.
4. Read the recovery email. Sign in to that address, on this device or another, and check that it opens. On the sheet, write which account it is, not its password.
5. Fix whichever is wrong. Where the provider allows it, add the new one before you remove the old one.
6. Add a recovery contact if the account offers one. Tell the person first.
7. Print a recovery code if the account offers one now (Microsoft does; Google's comes in Two-step sign-in and passkeys). Put it with your important papers and write the place on the sheet.
8. Write today's date in the Checked column.
9. Repeat for the device account if it is a different account from the main email: the Apple Account on an iPhone, iPad or Mac, the Google Account on an Android device or Chromebook, the Microsoft account on Windows.

7. Your setup Your setup

The box below reads your main email, your devices and whose accounts these are. It shows the recovery path for each account, and which of the steps above apply.

8. Check your work Check your work

Criteria

• Is the main email's recovery phone a number you have now, that gets texts and stays with you?
• Is the recovery email a different account, and did you sign in to it today?
• If the device account is a different account, did you check it too?
• Is there a recovery contact on each account that offers one, and does that person know?
• If you printed a code, is it on paper with your important papers, and does the sheet say where, without the code itself?
• Does every checked row carry today's date?

Worked example

Ruth's sheet (fictional) has a Gmail row with the recovery phone ending in her iPhone's last four digits, the recovery email as "a second address she can open," and today's date. Printed codes say "Two-step sign-in and passkeys," because Gmail's backup codes need two-step sign-in first. The Apple Account row names Maya as recovery contact, and the trusted-people sheet shows Maya with "they know" ticked. That meets each criterion that applies to her. It does not settle whether Google's change has taken effect; she looks again next week. Under that assumption, both of her main accounts have a working way back that does not depend on the landline.

Common mistakes

• Leaving an old number in place. A landline you gave up, or a work phone you no longer have, fails Google's test for a recovery phone. Read the number; do not assume it.
• Using the same account as its own recovery email. Google asks for an address that is not the one you sign in with. If the recovery email is the address itself, or an address you cannot open, it does not help.
• Removing the old method before adding the new one. For a short time the account has no way to reach you. AOL's steps add first, then remove.
• Choosing a recovery contact who cannot do the job. For Apple, the person needs an Apple device. Check before you send the invitation.
• Keeping the code where you cannot reach it when locked out. A code in your notes app or a photo in iCloud Photos is out of reach when the account is. Paper, with your important papers.
• Typing a code into the sheet. The sheet records where things are kept, not the code itself.

What is still unresolved

This chapter does not settle whether a company will let you back in on a given day. Each provider decides each request, and its waits apply. It does not settle whom to trust as a recovery contact; you do. It does not cover bank, card or phone company accounts, whose recovery rules are their own: Passwords changes their passwords, Two-step sign-in and passkeys covers the phone company's number lock, and Money and identity covers the bank's alerts. If you are locked out now, the quick start and When something goes wrong are the place to begin.

9. Knowledge check and scenario

Checklist

• The main email's recovery phone is a phone I have now.
• The main email's recovery email is a different account, and I signed in to it today.
• The recovery sheet shows the main email's recovery phone and email checked today, and where any printed code is kept.
• The account my devices sign in with is checked too, if it is a different account.
• A recovery contact is added on each account that offers one, and the person knows.
• If I have a Microsoft account, its recovery code is printed and kept with my important papers.
• The people I trust with a role are listed on the recovery sheet, with how to reach them. (Go deeper; optional)
• A date is on my calendar to look again a week after any Google recovery change. (Go deeper; optional)