Account Recovery Planning: Codes, Contacts and Backups

The way back into an account when you lose your phone or forget a password is also a way in for anyone who can fake being you, so recovery settings need as much care as the password itself. Most people set up recovery options once, years ago, and never look again: an old phone number, a university email address that no longer works, no backup codes. That leads to two bad outcomes, being locked out of your own email or photos for days, or a criminal using a weak recovery route to take the account. This guide explains each recovery option offered by Apple and Google, how strong each is, how to choose a sensible set for your situation, where to keep codes, and how to plan for the people who may need access if you are ill or die. It is written in plain language for individuals and families, and for the IT and awareness teams who help them. For the wider security settings on these accounts, see the Securing Your Apple ID and Google Account Guide.

Key takeaways

Start with your main email account. Password resets for almost everything else arrive there, so its recovery settings protect every other account you own.
Have at least two independent ways back in. A recovery phone plus printed backup codes, or a trusted device plus a recovery contact, means one lost item does not lock you out.
Every recovery option is also a door. Remove old phone numbers and email addresses you no longer control, and check the list twice a year.
Codes on paper, kept apart from your phone. Backup codes and recovery keys only help if you can reach them when your phone is lost or stolen, and Apple warns not to keep a recovery key only inside the account it protects.
Plan for others too. Apple Legacy Contact and Google Inactive Account Manager let family reach photos and documents after a death without anyone sharing a password.

Why recovery is where accounts are won and lost

Recovery exists for the moment you cannot prove who you are in the normal way. That makes it the easiest place for a criminal to try, because the service is already expecting the person on the other end to have lost something. Three patterns cause most trouble.

Stale recovery details: a phone number you gave up, an email account at an old employer or a provider you no longer use. If someone else now controls that number or address, they may be able to receive your reset codes.
Weak recovery channels: text messages can be redirected if a criminal persuades your mobile operator to move your number to their SIM. See the SIM Swap Fraud Guide.
Persuadable support: help desks and automated assistants that can be talked into adding a new email address. In 2026 Meta reported that its AI support assistant sent account recovery links to attackers for 20,225 people; Meta's letter said accounts with two-factor authentication turned on were not taken over. See the Meta AI Instagram Account Takeover 2026.

The NCSC's advice for a hacked account starts with your email: check it for forwarding rules and filters, because criminals set these up to receive copies of your mail and reset your other passwords. That is the same reason email recovery settings come first in any plan.

Recovery options compared

Option	Where you find it	Strength	Main risk	Best used as
Trusted device you are already signed in on	Apple and Google both use signed-in devices to approve changes	Strong	Lost or stolen together with your phone	Your everyday route back in
Passkey or security key	Account security settings	Strongest against phishing	Lose every copy and you need another route	Main sign-in method, with a second key or synced passkey as spare
Recovery phone number (text or call)	Google: Security, recovery phone; Apple: trusted phone numbers	Moderate	Number changes hands, SIM swap	One route among several, on a number only you use
Recovery email address	Google: Security, recovery email	Depends entirely on that email's own security	Old or weakly protected address	A second address you check, protected with its own two-step verification
Backup codes	Google: 2-Step Verification, Backup codes	Strong if stored offline	Stored in a place you cannot reach when locked out, or found by someone else	The fallback when your phone is gone
Recovery contact (Apple)	Settings, your name, Sign-In and Security, Recovery Contacts	Strong	Contact unreachable, or you forget who it is	Help from a trusted person without them seeing your account
Recovery key (Apple)	Settings, your name, Sign-In and Security, Recovery Key	Very strong	Lose it and Apple cannot help: you may be locked out permanently	Only for people at high risk who can store it reliably
Provider account recovery process	Apple iforgot.apple.com; Google account recovery page	Slow by design	Can take days; may fail if details are out of date	Last resort

Setting up recovery on a Google account

Turn on 2-Step Verification at myaccount.google.com under Security, if it is not already on. The NCSC recommends two-step verification on your most important accounts, such as email, banking, social media and online shopping. See the Two-Factor Authentication for Everyone Guide.
Set a recovery phone that receives texts, belongs only to you and that you carry. Google warns not to use a Google Voice number as a recovery phone, because codes sent there cannot be retrieved when you are locked out.
Set a recovery email that you check regularly but which is not the address you sign in with. Make sure that second account has its own two-step verification, or it becomes the weak link.
Print or download backup codes. Google issues sets of ten 8-digit codes; each works once. Find them under Security, 2-Step Verification, Backup codes. Refreshing creates a new set and cancels the old one, so do that if you lose the sheet or think someone has seen it. Google suggests keeping them somewhere safe, such as with your passport or other important documents.
Add a passkey or security key if you can. Google notes that a trusted passkey or security key may speed up changes to recovery details.

Good to know: Google says changes to a recovery phone can take up to 7 days to take effect, and it may keep sending codes to your previous recovery details for 7 days so you can stop someone who changed them. If it spots a recovery method it thinks is suspicious, it disables it and gives you 30 days to confirm. These delays are protections: do not try to rush them.

Setting up recovery on an Apple Account

Check trusted phone numbers: Settings, tap your name, Sign-In and Security. Remove any you no longer use and add a second number you control, such as a partner's phone, if you are comfortable with them receiving codes for you.
Add one or two recovery contacts: Settings, your name, Sign-In and Security, Recovery Contacts. You can add up to five. A recovery contact never sees your account: during recovery they get a six-digit code on their own device and read it to you. Apple does not know who your recovery contacts are, so write their names down with your other recovery notes.
Decide about a recovery key: a recovery key is a 28-character code. Turning it on switches off Apple's normal account recovery, so you then need the key plus a trusted phone number to reset your password. Apple says that if you lose it and cannot sign in, you may be locked out permanently and Apple cannot provide a replacement. Most people are better served by recovery contacts; a recovery key suits people facing targeted attacks who can store it reliably.
Store the key outside Apple: Apple advises not keeping a recovery key in Passwords, iCloud Photos, Notes or iCloud Drive, because you could not open them to find it if you lose access.

If you are locked out: Apple's account recovery has a waiting period that Apple Support cannot shorten. You should receive a confirmation within 72 hours, and you can check progress at iforgot.apple.com. Signing in on any of your Apple devices cancels the request, and sending more requests can make the wait longer. If you receive a recovery confirmation you did not ask for, use the cancel link in the email at once: someone may be trying to take the account.

Choosing the right set for your situation

Situation	Suggested recovery set	Avoid
Most adults with one phone	Passkey on the phone, recovery phone, recovery email with its own 2SV, printed backup codes, one Apple recovery contact	Relying on the phone alone
Older relatives	A recovery contact or recovery phone belonging to a trusted family member, printed codes kept with important papers	Recovery keys they may lose; sharing passwords instead of setting up contacts
Teenagers	Parent as recovery contact or recovery email, school or family devices kept updated	An abandoned email address from childhood as recovery
People at high risk (public figures, journalists, people leaving an abusive relationship)	Two security keys, Google Advanced Protection where suitable, Apple recovery key stored offline, recovery contacts reviewed carefully	Recovery details that a current or former partner can reach
Small business owners	Separate business and personal accounts, two admins on business accounts, codes held in a safe place known to a second person	One person's personal phone as the only recovery route for the business

If someone close to you may misuse access, be careful: a recovery phone, recovery email or recovery contact that they control gives them a way in. Review them in private and change them before making other changes they might notice. See the Technology-Facilitated Abuse Safety Guide.

Where to keep codes and keys

Paper first: print backup codes and recovery keys and keep them with documents you would rescue in an emergency, such as your passport. Keep a second copy somewhere else, such as with a trusted relative, in a sealed envelope.
A password manager is fine for codes, not for the only copy of the key to itself: keeping Google backup codes in a password manager helps day to day, but if that password manager is unlocked through the same account you are trying to recover, you will not reach them. See the Password Managers Explained for Everyone Guide.
Never in the account it protects: not as a photo in your cloud gallery, not as a note synced to the same account, not as an email to yourself.
Label without revealing: write which account a sheet belongs to, but not the password. Codes without the password are far less useful to a thief, and the password should not be on the same paper.
Refresh after use: once you have used several codes, or if a sheet might have been seen, generate a new set; the old one stops working.

Planning for illness and death

Families often find that photos, documents and accounts are lost when someone dies or becomes unable to manage their affairs. Sharing passwords is not the answer: it breaks the security you set up and may break the service's terms. Both providers have a proper route.

Apple Legacy Contact: Settings, your name, Sign-In and Security, Legacy Contact. The person you choose gets an access key and, after your death, can request access with that key and a death certificate. They can reach photos, messages, notes, files and device backups, but not purchased films, music or books, and not Keychain data such as passwords and passkeys. You can name more than one, and each can decide what happens to your data, including deleting it.
Google Inactive Account Manager: set it up at myaccount.google.com/inactive. You choose how long Google waits after your account goes quiet, and up to 10 people to notify or share chosen data with. They hear nothing until the waiting period ends, and they verify themselves by phone before downloading. Google says it may delete accounts that have been inactive for at least two years with no plan in place.
Write it down: keep a short note with your will or important papers listing which accounts exist, who the legacy and recovery contacts are, and where codes are stored, without writing passwords.

A 30-minute recovery review

Main email first: check recovery phone, recovery email and backup codes; remove anything out of date.
Look for forwarding rules and unknown devices in email settings, as the NCSC advises, and sign out of devices you do not recognise.
Apple and Google: confirm trusted numbers, add a recovery contact, print new backup codes.
Banking and mobile operator: check the phone number and email they hold, and ask your operator about any account PIN or port-out protection it offers.
Test one route: on a quiet day, sign out on one device and sign back in using a backup method to prove it works. If it fails, fix it now rather than during an emergency.
Diary a reminder to repeat this every six months and whenever you change phone number, email provider or phone.

Signs your recovery settings have been tampered with

An email or text saying a recovery phone, recovery email or recovery contact was added or changed when you did not do it.
A message from Apple confirming an account recovery request you did not make.
Backup codes reported as used or refreshed, or a new security key or passkey you did not add.
Your phone suddenly losing signal and showing "SOS only" or "no service" in a place where it usually works, which can mean your number has been moved.

If you see any of these, act from a device you trust: change the password, remove unknown recovery details and devices, and follow the provider's hacked account steps. See the Hacked Social Media or Email Account Recovery Guide.

For organisations: where this sits

Employers, banks and community organisations that support people with their accounts can use this plan in awareness programmes, and the same principles apply to staff account recovery at the help desk. See the Account Recovery and Help Desk Security Guide.

Topic	NIST CSF 2.0	NIST SP 800-53 Rev 5
Teaching people to set and review recovery options	PR.AT-01	AT-2 Literacy Training and Awareness
Managing backup factors and lost authenticators	PR.AA-01, PR.AA-03	IA-5 Authenticator Management
Proving identity before a recovery change	PR.AA-03	IA-12 Identity Proofing

Measures that show a programme is working: share of staff or customers with two or more recovery methods; share with backup codes generated; recovery requests completed without help desk overrides; account takeovers that began through a recovery flow; and time taken to restore access after a lost phone.

Common failure patterns

Phone as the single point of failure: passkeys, authenticator app and recovery number all on one handset, with no codes. Losing the phone means losing everything. See the Stolen or Lost Phone guide.
Old recovery email: a forgotten address at a provider that recycles inactive accounts, or a work address you can no longer reach.
Codes stored inside the account: a screenshot of backup codes in the cloud photo library of the account they protect.
Recovery key without a plan: turning on an Apple recovery key, then losing it, which Apple says can mean permanent lockout.
Trusting an unexpected call: no genuine provider will phone to ask you to read out a recovery code or backup code. Google says it never asks for a backup code except when you sign in.
Rushing the wait: sending repeated recovery requests, which Apple says can extend the waiting period.

Practitioner checklist

Turn on two-step verification on your main email, then on banking and social media.
Confirm every recovery phone and email is current and controlled only by you.
Make sure your recovery email has its own two-step verification.
Print Google backup codes and store them with important papers, plus a second copy elsewhere.
Add at least one Apple recovery contact and note who it is.
Only turn on an Apple recovery key if you can store it offline in two places.
Set up Apple Legacy Contact and Google Inactive Account Manager.
Test one backup route on a quiet day and repeat the review every six months.

Account Recovery Planning Guide: Set Up Your Way Back In Safely