Learn

Check your email's recovery info before you get locked out

Password resets for everything else land in your inbox, which makes your email account the master key. The recovery phone and backup email on that account are how you get back in, and most of us set them years ago.

Think about what happens when you forget a password. The bank, the pharmacy, the streaming account. You tap "Forgot password" and the reset link lands in your email. That inbox is the master key to almost everything else you do online.

So what happens when the account that gets locked is the email itself?

That is what recovery info is for. A phone number and a backup email address on file, so the company can prove you are you and let you back in. Here is the catch: most of us set those up the day we opened the account and have never looked at them since. The phone number from three phones ago. A backup address from an old job, or an internet provider you left years back. When the lockout comes, the code goes to a number that no longer rings for you.

This check takes five minutes, and it only works in one direction. Signed in, updating your recovery info is a couple of clicks. Locked out, it is a different story. If Google can't reach you at anything on file, you are into an automated recovery form with no person behind it. If Microsoft has to replace all of your security info, the account goes into a 30-day hold before the new info works. Five minutes now, or thirty days later.

Start with your main email account, the one everything else sends its reset links to. That is the whole tip. If you keep a second account, run the same check there another day.

One habit while you do this: type the addresses below yourself instead of following a link from an email. That is the same habit that keeps you off phishing pages.

If your email is Gmail

Go to myaccount.google.com and sign in. On a phone, you can also open the Gmail app, tap your photo in the top right, then tap "Manage your Google Account."
Tap or click "Security."
Scroll to the section called "How you sign in to Google." You are looking for "Recovery phone" and "Recovery email." On some screens the section reads "Security & sign-in."
Open each one and read what is there. Is that phone the one in your pocket right now? Can you still open that backup address? If either answer is no, update it on the spot.

Two things Google itself warns about. A new recovery number can take up to a week before Google fully trusts it, one more reason to do this before you need it. And don't use a Google Voice number as your recovery phone. If you are locked out, the code goes somewhere you can't reach.

If your email is Outlook, Hotmail, or Live

Go to account.microsoft.com and sign in.
Click "Security."
Look for "Manage how I sign in." Microsoft may land you on a page called "Security info." Same place.
Read the list of phone numbers and email addresses. Remove anything you no longer control. To add a current one, use "Add a new way to sign in or verify."

One note here: Microsoft has said it is phasing out texted codes for personal accounts. The backup email address is the piece to get right, and the Microsoft Authenticator app or a passkey is what they will steer you toward. We covered what a passkey is if that word is new.

Any other email

Yahoo, AOL, your internet provider's mail. Same idea, different menus. Sign in on the web and look for "Account security" or "Account info." It might be tucked under "Sign-in and security" if there is no security section on its own.

The most important step

Don't stop at "something is listed." Read it. The check is whether it reaches you today: the phone that rings in your pocket, the inbox you can open right now. A backup address you lost access to in 2019 is the same as no backup at all.

While you are on that screen, Google now offers "Recovery contacts," a trusted friend or family member who can vouch for you if you get locked out. Optional, but a nice fit for an older parent's account.

We covered who gets your photos and email when you're gone a few weeks back. This is the nearer-term version of the same housekeeping: making sure the person who can get back into your account is you.

If you run this check and the phone number on file turns out to be from three phones ago, I would like to hear about it.