AKA what not to do.
Literally1 not a day goes by that I don’t hear from someone in the middle of an account recovery process that isn’t working.
While I try to help out to the degree that I can — usually with instructions that are often no more than the service provider’s instructions translated into clearer English — it’s not uncommon for those account recovery efforts to fail and access to the account never be regained.
Ever.
And, at the risk of being seen as blaming the victim, to be super blunt about it, most of the time it’s the account owner’s own fault.
How to lose your account
Account recovery usually fails because recovery information (like alternate email addresses and phone numbers) was never configured or wasn’t kept up to date. It’s important to set and review them regularly to make sure they’ll be there if and when you need them.
The most common reason for failure
Almost every online service has ways to recover lost passwords or regain access to accounts. Those account recovery processes typically involve sending an email to an alternate email address, a text message to a phone, or something else.
Those are reliable ways to prove you are the rightful owner of the account and should be allowed back in. Anything less would allow hackers to impersonate you or otherwise scam the system to break into accounts where they have no business being.
The problem?
Many people don’t set up this recovery information, and those that do may not keep their information current.
Without it, there’s really no hope for recovery.
Help keep it going by becoming a Patron.
Related
Do I Really Need a Recovery Email?
Alternate email addresses can allow you to regain access to your account if it's hacked or you forget your password.#151482
Alternate email addresses
These days, you need more than a single email address.
You need at least two.
The first you consider as your real or primary address. The second you use as an alternate email address for that primary account. You use it when you need to prove that you are you…
…like when you forget your password on the primary account or your account is hacked.
How do you prove you are you? By being able to access the alternate email account you set up while the primary account was in your control (usually when you first set it up). Account recovery frequently involves sending a password-reset link, code, or some other information to that email address. When you collect the information and use it, you’ve proven you have access to that account. Since you’re the one who set it up as the alternate account, you must be who you say you are, and thus you should be allowed back into the account.
Never set up an alternate email address? You can’t recover the account.
Lost access to the alternate email account? You can’t recover your primary account.
Related
When You Change Your Phone Number, Change Your Phone Number
The ability to keep your old phone number when getting a new phone can avoid several headaches. If you get a new number, there are steps you must take.#168318
The conundrum of the phone
Many services allow you to associate a phone number with your account.
Overly paranoid folks believe this amounts to more ways for the service in question to keep tabs on them.
I disagree strongly.
Phone numbers are another way to prove you are who you are. Rather than sending you an email, services can send you a text message with a recovery code, or, in some cases, a recorded voice that reads the recovery code to you. Your ability to receive a code at the phone number you provided proves you must be you and should be allowed back into the account.
The conundrum I allude to is twofold.
- Many services only support text messaging, and thus only mobile phones. You’ll need to use a different alternative authentication mechanism — like that alternate email account — if you don’t have a mobile phone.
- This may easily fail if you lose access to your account or are asked for additional validation while traveling outside your own country. Once again, make sure you have an alternate identification mechanism in place — like that alternate email address — before you leave.
Losing your account in one easy step
Pick whichever approach you like:
- Don’t set up authentication mechanisms like alternate email addresses or phone numbers at all,
or
- Let your alternate authentication mechanisms expire or change without updating the account for which they’re the alternate mechanism.
Either works. You’ll lose access to your primary account forever if you ever get hacked or lose your password.
Do this
To avoid losing access to important accounts, I strongly recommend you:
- Set up an alternate authentication mechanism on your important accounts.
- If you already have, make sure they’re all still valid.
I also recommend that you take advantage of all the alternate mechanisms offered.
- Set up an alternate email address and keep that alternate email address active.
- Set up more than one alternate email address if you can.
- Associate a mobile phone number with the account.
- If you don’t have a mobile and the service will do voice calls (reading you a recovery code), then associate a landline number with the account.
And above all, any time any of the above changes — you get a new phone number or email address, for example — make absolutely certain to update the information in your accounts. Alternate email addresses or phone numbers do you no good if you no longer have access to them.
Want another way to stay on top of current security options? Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
Podcast audio
Footnotes & References
1: Where “literally” literally means literally. 
Google couldn’t verify this account belongs to you. This happened because Advanced Protection is turned on for this account. For your protection, you can’t sign in right now.
I have tried many times to recovery my gmail account as I have forgot my alternative email id also so I coundnt recover my account. plz help..
do I need to wait for 2 weeks.. as I have read somewhere that its takes 2 weeks to unenrolled automatically from advance protection of gmail account if I wont apply for security key.
We cannot help you. This underscores the importance of always keeping your alternate account recovery information up to date.
So. There are a lot of ways to get /setup recovery information. The problem I have is that there are so many sites to protect/recover, that I had to design a spreadsheet to organize them all. What is a good way to organize them. I want to be able to hand my spouse a copy so she can use the sites if I’m gone. A printed version is in the home office safe. Any template suggestions or alternative recommendations?
The best way to manage Web passwords is with a password manager like LastPass. It keeps your passwords in a vault protected by a master password. That’s why it’s called LastPass because it’s the last Web password you’ll need to remember. It keeps your passwords synchronized on all your devices. If you prefer one which doesn’t keep a copy of the encrypted vault on their servers, you might prefer KeePass.
Leo no longer recommends LastPass due to their mishandling of a breach. He now recommends 1Password, BitWarden, or ProtonPass.
LastPass Breach 2022: My Recommendation
I have upgraded my Note 10 to android 11. After that, I can’t sign to my google account via android phone. I’m getting a message ; “You’ve tried to signin too many times. For your protection, you can’t sign in right now. Try again later or sign in from a different device”. I normally log in via a web browser and select that device as secure but I still get the same message 🙁
I LOST MY PHONE NUMBER SOME ON HELP ME TO RECOVER MY GMAIL ACCOUNT PLEASE BROTHER
Please review the account recovery options as outlined in this article: https://askleo.com/access-gmail-without-phone-verification/
If Google’s recovery process doesn’t work for you — maybe you don’t have the recovery email or phone — MAKE SURE to follow Facebook’s instructions CAREFULLY and COMPLETELY.
If the Google recovery process can’t be made to work, I know of no way to recover the account. If that’s your situation I’m very sorry.
If you DO recover your account you’ll want to check the steps in this article to prevent losing it again: https://askleo.com/facebook-hacked/
Many people have complained about outlook.com (Hotmail. live.com. msn.com) because of being locked out of their accounts due to traveling etc. It appears they’ve payed attention to those complaints and added the option of downloading a recovery code for the account. Of course, you can lose that, but if you retain a few backup copies, you should be safe. This circumvents the problem of changing phone numbers, hacked account, or traveling out the country. I used to hate Hotmail, but now, it’s probably on of the most secure free email service providers because of that recovery option.
Microsoft Account Recovery Code What and why with instructions included
Can you help me because I needed to log in my gmail & for my phone but well it’s still lost my Iphone at all man broken.
Read the article you are commenting on. If you don’t have the recovery email recovery accounts or the recovery phone number, your account is unrecoverable.
Hi I have a Gmail account that was hacked the phone number was changed and I believe the password was changed because I cannot get in it I’m a senior citizen and I’ve had that account that I’m trying to get back into for over 10 years it’s got a very important pictures on it videos and items that I need to have to have with me when I go to court against someone who has stole my identity can you please help me out I do have a recover email to go to it but it’s not nothing’s going to it please help me out
(Sorry for the form response, but I get this question A LOT.)
Please review the account recovery options as outlined in this article: https://askleo.com/access-gmail-without-phone-verification/
If Google’s recovery process doesn’t work for you — maybe you don’t have the recovery email or phone — MAKE SURE to follow Google’s instructions CAREFULLY and COMPLETELY.
If the recovery process can’t be made to work, I know of no way to recover the account. If that’s your situation I’m very sorry.
If you DO recover your account you’ll want to check the steps in this article to prevent losing it again (it discusses Facebook, but the steps apply to Google as well): https://askleo.com/facebook-hacked/
good article fist thought I don’t want to know what not to do but its well set out and i’ve learned stuff so thats good
Hello good day, I lost my phone someone rob it at store, I forgot my gmail pass and I really need to recover it. All I need is my newborn pictures it’s a treasure for me. Pls help I really do appreciate you, it means a lot for me, thankyousomuch! This is my current gmail acc
We can’t recover accounts. Here are a couple of articles on recovering email accounts.
Would You Please Recover My Password?
How Do I Access Gmail Without Phone Verification?
Hi,
I need to recover one of my gmail account, but i havent provide recovery mail oe phone number added to this account.
And i dont remember the password too.
How can i recover my account. I do have info of the date i created this gmail
Sorry for the canned response, but this is a question that comes up often:
Please Recover My Password
Lost Gmail Account Recovery With No Phone or Alternate Email
Unfortunately, if you no longer have access to the recovery email account and phone number, or you can’t supply enough information to recover your account, your account may be lost forever, although some websites have a way of recovering accounts using older recovery email accounts or phone numbers in case of hacks. It’s important to always keep these up to date on your account.
I need to recover one of my gmail account, but i havent provide recovery mail oe phone number added to this account.
And i dont remember the password too.
How can i recover my account. I do have info of the date i created this Gmail
(Sorry for the form response, but I get this question A LOT.)
Please review the account recovery options as outlined in this article: https://askleo.com/access-gmail-without-phone-verification/
If Google’s recovery process doesn’t work for you — maybe you don’t have the recovery email or phone — MAKE SURE to follow Google’s instructions CAREFULLY and COMPLETELY.
If the recovery process can’t be made to work, I know of no way to recover the account. If that’s your situation I’m very sorry.
If you DO recover your account you’ll want to check the steps in this article to prevent losing it again: https://askleo.com/google-account-hacked/
Good luck!
I found your article through Bing since I’m in the middle of waiting for my Facebook account to be restored because the bots assumed it had violated policy and TOS (you know how it is). I couldn’t get them to send me a code by text, so I had to install WhatsApp just to be to get back. Now I should be cleared soon since this happened with Instagram last year and I was also hacked to boot. The one solace with WhatsApp is I can still use Meta AI, but otherwise few people use it anymore. The allegedly “legal” hackers is what led me here, and people on X said to get one, but I can’t afford to spend money like that, and I figured it was fraud when Meta assume I’m deceiving others. You may have saved me and many others from falling further down the rabbit hole.
99.9999999999999999999999999999999999999999999999999999999% (or more) of “legal” hackers are scammers. No one can help you recover a hacked account.
If you are a regular reader of Ask Leo! you know how he stresses the importance of backups. Only one recovery address means it’s not backed up. It important to have at least 2 or 3 alternate recovery addresses along with a recovery phone number. Most ebsits allow alternet recovery addresses. I have half a dozen email addresses and if one fails, I have more to assist in recovery,
So, even if I use passkeys for login I assume these methods are still recommended (not necessarily required) for account recovery, yes? Of course, when AI is able to crack passkeys we’ll be screwed with their use. (I just don’t want to make an arse out of u or me!)
Be sure your ALTERNATE email address is with a DIFFERENT vendor. This is extremely important if you travel outside your normal area, as some vendors will FORCE you to “RECOVER” your email account because your IP address that you are using is different from your usual one. If you try using the same vendor, now BOTH email accounts are locked and … no recovery may be possible. Voice of actual experience.
Here’s a question.
Although I rarely use it, I do I have a Gmail address. If it was to get hacked someday, wouldn’t the hacker be able to see the alternate email address attached to it & be able to change/delete it?
Yes, if a hacker gets into your account, they can and usually do change the recovery information.
Change or confirm your recovery information.
I don’t have 2FA set with gmail because I use Thunderbird to check my 3 email accounts. However, is it possible to use 2FA with Thunderbird and how does it operate? Will Thunderbird need 2FA every time it checks for email or what?
This depends on the specific account with which you have 2FA set up. With Microsoft and Google accounts, for example, it works.
I lost one (and the associated emails). Yes, I apparently (maybe) lost the password (after many years), but there is no way to recover it. Account was originally swbell.net, which was apparently sold to Yahoo.com. Then that was broken off to ATT.net. By the time I switched iPhones (where the password was automatically stored), the update to the new iPhone did not carry over the password (security). Problem: The new provider (ATT) no longer has the option for a human. It does indeed have the “Forgot password” link, which wants to use several ways (alternate email or phone number) – NONE of which were available when the account was set up. So … goodbye history.
“A One-Step Way to Lose Your Account Forever”: In my experience, avoidance, prevention and preparation are paramount to changing disaster to inconvenience.
1. Avoidance:
A. Use unique, long, strong passwords consisting of random characters for every Internet-based account
1. Securely store all passwords in a manager to mitigate or eliminate many security threats.
B. Activate 2FA for all Internet-based accounts (prevents most account take-over attacks).
1. If an account doesn’t offer/support 2FA, consider seeking an alternative that does
C. Use passkeys where available.
1. Store passkeys in your password vault
a. Allows access from multiple devices
b. Mitigates issues when adding/upgrading to a new device
2. Prevention:
A. NEVER share account passwords or other personally identifiable information with ANYONE
1. Includes long-term friends/family members!
2. Exceptions exist
a. Medical, Insurance, and Government providers/services, etc.
3. When collaboration or information sharing are desired or required:
a. Consider self-hostable or Internet-based software/services
I. Whiteboards cloud storage, self-hosted storage servers, etc
II. A group can share access to cloud storage, etc. with caveats
a. Access passwords MUST change when any member departs the group
B. See Avoidance (above) for additional recommended actions
3. Preparation:
A. Backup everything that matters, or is irreplaceable
1. If it’s in fewer than three locations, it’s not backed up
a. On your local drive for normal access
b. In an image stored on an external drive, or on locally hosted server storage (on your LAN)
c. On storage hosted by a cloud service, preferably which offers true end-to-end encryption
2. Implement an automated backup regimen using the utility of your choice
B. Implement everything above to establish a well rounded security paradigm
As Leo consistently reminds us, perfect security does NOT exist, and is impossible. However, if you implement everything I’ve outlined here, the likelihood that any account you have will ever become compromised as the result of a failure on your part will be eliminated, and the likelihood that any account you have will ever become compromised will be as minimized as possible. That’s the best you can ever hope for in our world as it is today. Further, consider this my ‘I-told-you-so’ message if you fail to follow my recommendations, and you lose access to any account you currently have!
Ernie