A jade padlock supported by a vermilion rescue ring reflects the value of preparing a secure route back to an account.
A lost phone or forgotten password should not become the moment you discover how much of your life depends on one way in
By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.
Imagine that you have finished an application you care about. The documents are ready, the deadline is close, and the final confirmation is waiting in your email. Then your phone stops working. You know your password, but the account asks you to approve the sign-in on that phone. Your spare codes are somewhere in the same inbox you cannot open.
Nothing in this example requires an attacker. An ordinary broken device has interrupted something important because every route back depended on the thing that failed.
We give considerable attention to keeping other people out of our accounts. We also need to think about how the rightful owner gets back in. That deserves a little calm attention while access still works, before fatigue, urgency and uncertainty make every decision harder.
An account recovery plan can be modest. It should identify which accounts matter, what each service actually permits, and how the legitimate owner can use an approved alternative if the usual sign-in method disappears. The details will differ across providers. Preparing them is a practical act of care for your work and for anyone depending on it.
This is a different task from backing up files. A copy of your documents may preserve their contents without restoring your ability to send email or administer a website. Recovering account access, in turn, does not necessarily recover deleted content. Consider both needs when protecting your work.
Begin with the accounts that open other doors
Some accounts have a reach far beyond their own contents. An email address may receive password-reset messages for several other services. An organisation's administrative account may control access for an entire team. A password manager may hold the information needed to enter many different accounts.
Start with a short inventory of these important connections. You do not need a document containing every password. A private list of account names, their purpose and the location of official recovery guidance can make the dependencies easier to understand without gathering secrets in one ordinary file.
Ask a concrete question: if this account became unavailable today, what else would become difficult to use?
For a student, the answer might include a course portal and scholarship correspondence. For a small charity, it could include its website, donor communications and shared documents. These are illustrative examples, but the exercise is useful precisely because the answer will be different for each person or organisation.
Give the accounts with the widest consequences your attention first. Trying to improve everything in one sitting can turn a manageable task into something you postpone indefinitely.
Find out what recovery means for each service
Forgetting a password, losing a second verification method and losing control of an email address are different problems. A route designed for one may not solve another. The phrase “recovery code” is not a promise that every obstacle will disappear.
Google's account guidance offers a useful example. For eligible accounts with 2-Step Verification enabled, backup codes can replace the usual second step when you cannot receive a verification code or use a security key. Each code works once, and creating a new set makes the previous set inactive. These codes address that second step; do not assume they also solve a forgotten-password problem. Google's backup-code instructions
Other services have different arrangements. Some provide recovery keys, some allow additional authentication methods, and some require an administrator or a longer identity-verification process. A plan copied from a different provider may give you confidence without giving you a usable route back.
While you are signed in, read the provider's current instructions. Establish which options are available for your account type, what you must arrange in advance, and what happens if more than one method is lost. Keep a link to that official guidance where you can reach it without opening the affected account.
Look for failures that would remove several options together
Two listed options may still depend on the same device. An authentication app and an email inbox on one phone can both become difficult to reach when that phone is lost. A recovery file kept only inside the locked account cannot help you enter it.
The important question is whether your alternative remains available under the particular failure you are planning for. Imagine a lost phone, a damaged laptop or an unavailable team member. Follow the chain of steps on paper. Where does it circle back to something you have already lost?
The US National Institute of Standards and Technology addresses this principle in its digital identity guidance. It recommends encouraging users to bind at least two separate means of authentication to an account, helping address the loss or malfunction of an authenticator. That is guidance for systems and their operators, with requirements that depend on assurance level. It is also a useful prompt for users to inspect the supported alternatives their own providers offer. NIST digital identity guidance
Where a service supplies backup codes, follow its storage guidance and treat them as secrets. If you choose a protected physical copy, consider who can access it and how you will find it. If you choose secure digital storage, consider whether that storage can still be reached during the failure you are planning for.
There is no storage arrangement that suits everyone. A shared home, frequent travel, disability or limited access to another device can change what is practical. The aim is a method you can actually use, with protection appropriate to what it unlocks.
Keep strong sign-in protection in place
It can be tempting to respond to the fear of lockout by switching off extra security. That creates a different exposure. Preparation should preserve strong sign-in protection while making the approved recovery routes clearer.
NIST's small-business cybersecurity guidance recommends phishing-resistant multifactor authentication where it is offered, particularly for sensitive accounts. Where your service supports it, use the provider's guidance to understand an appropriate method and the recovery arrangements that go with it. Availability can differ by service and account type. NIST cybersecurity basics
Do not assume that moving to a new sign-in method automatically settles every recovery question. Check what happens when a device is replaced, which alternatives remain available, and whether your recovery information needs attention. Make changes carefully, one step at a time, using the provider's instructions.
Recovery information itself needs upkeep. An old phone number or abandoned email address can look reassuring in settings while being useless when needed. Google warns that changes to recovery information may take up to seven days to take effect. A last-minute update should not be treated as an instant guarantee of restored access. Google's account-recovery guidance
Organisations need accountable access that can survive an absence
An organisation faces a further question: what happens when the person who knows how everything works is unavailable?
A volunteer may change roles. A founder may become ill. A staff member may leave without remembering every service they originally set up. Technical access and the authority to use it need to remain clear through these ordinary changes.
The answer should use the service's legitimate administrative controls, with named responsibilities and appropriate permissions. It should not depend on circulating one powerful password through a group chat. People should have the access needed for their role, and the organisation should know who can authorise recovery or a change of ownership.
Google Workspace's administrator guidance, for example, recommends more than one super administrator, with each person using an identifiable account. It also recommends keeping daily activity separate from super-administrator work. These are Workspace-specific practices, rather than a reason to grant everyone broad privileges on every platform. Google Workspace administrator security practices
For a small organisation, a useful conversation can begin with its most important service: who is responsible, who is the authorised backup, and where are the provider's instructions? Sensitive systems may require qualified technical support to configure this safely. A continuity plan is only helpful if its permissions and safeguards are sound.
Rehearse the steps without creating an emergency
You do not need to lock yourself out to discover whether your plan makes sense. Start with a quiet walkthrough while your normal access is working.
Check that you know which account is being protected. Confirm that recovery addresses and numbers remain usable and any recovery contacts are still trusted and reachable. Locate the official instructions and establish whether the fallback you intend to use is actually configured. Check that you can find the protected storage location without copying its contents into an unprotected note.
If a provider offers a safe way to verify an additional method, follow that procedure. Avoid removing your working method, signing out everywhere or deliberately consuming a one-time code just to make the exercise feel realistic. Any real recovery test should follow provider guidance and account for the possibility of interruption.
A walkthrough can also reveal a human problem. The instructions may be difficult to read. A colleague may not know what their backup role means. The only suitable storage location may be inaccessible to the person who needs it. Finding these issues in advance gives you time to arrange something workable.
Review the plan when something relevant changes, such as a new phone, a new number, a different recovery address or a change in organisational responsibility. A plan tied to devices and people needs to move with them.
Protect yourself when urgency arrives
Even good preparation cannot guarantee recovery. Providers may impose waiting periods, require checks you cannot immediately complete or be unable to restore access. An honest plan makes room for that uncertainty and identifies which work may need to pause.
During a lockout, start from the service's official website or application. Google explicitly warns that it does not work with services claiming to provide account or password support, and that people should not give away passwords or verification codes. Someone promising an immediate fix may be seeking the very access you are trying to recover. Google's recovery and scam warning
A trusted person can help you read instructions or think through the options without taking possession of your secrets. In an organisation, use its authorised support route and record the necessary operational decisions without putting passwords or recovery codes into the incident notes.
Once access is restored, follow the provider's security-review instructions and update the plan. Replace or revoke lost methods where appropriate. Check whether any one-time material was consumed or replaced, so an old copy does not quietly become tomorrow's problem.
The best moment to begin is usually an uneventful one. Choose one important account, read its recovery guidance and find the weakest dependency. You may discover that your arrangements are already sound. You may discover a small gap that is easy to close.
Either way, you will have done something useful before a broken phone or an unexpected absence makes it urgent. That is time well spent for anyone whose work, relationships or responsibilities live behind a sign-in screen.
