Email Recovery Settings Explained
Recovery settings decide whether you can get back into your email, and whether an attacker can. What each option does, how to set them up, and the mistakes that cause lockouts or takeovers.
Recovery settings are the back door to your email. Set up well, they get you back in quickly when you forget a password or lose a phone. Left out of date, they can lock you out for good, or let someone else in. Here is what each option does and how to get them right.
The main recovery options
| Option | What it does | Get it right by |
|---|---|---|
| Recovery phone | Receives codes to reset your password | Using your current number, and updating it when it changes |
| Recovery email | Receives reset links and security alerts | Using another secure account you control and check |
| Backup codes | One-time codes to sign in without your phone | Saving them offline. See backup codes |
| Passkeys and security keys | Strong sign-in methods that also help recovery | Registering at least two devices |
| Security questions (older accounts) | Answers used to verify you | Using random answers. See security questions |
How to review them
- Sign in to your email through the official app or website.
- Open the security or account section and find "Recovery" or "Ways we can verify it's you".
- Confirm the phone number and email listed are yours and current.
- Remove anything old or unfamiliar.
- Add backup codes or a second passkey if you have not already.
Common mistakes
- An old phone number you no longer have. Numbers are recycled and reassigned. See phone number recycling.
- A recovery email you cannot access, such as an old work or school address.
- Two accounts recovering each other, with the same password on both.
- No backup method at all, relying on a single phone.
After any suspicious activity, check recovery details first. Attackers often change them so they can take the account back after you recover it.
If you are locked out
Use the provider's official recovery page, from a device and location you have used before, and answer as fully as you can. See how to recover a hacked email account. Beware of anyone offering to recover it for a fee.
Got an email asking you to "update recovery information"? Paste it into CyberWatch AI Scan for a free check, and update settings only by signing in yourself.
For more, see how to secure your email account and our guide to identity theft and account security.
Frequently asked questions
What happens if my recovery phone number is out of date?
You may be unable to recover your account if you are locked out, and if the old number is reassigned to someone else, they might be able to use it to reset your account. Update it as soon as your number changes.
Should my recovery email be another of my own accounts?
Yes, ideally a secure account you control and check, protected with its own unique password and two-step verification.
Can an attacker change my recovery details?
Yes, if they get into your account. That is why you should check recovery details after any suspicious activity.
Sources
- Tips to complete account recovery steps, Google Account Help
- Sign in with backup codes, Google Account Help
- Recovering a hacked account, UK National Cyber Security Centre
