How do I recover an account I am locked out of?

Account recovery is deliberately awkward, because an easy recovery process is also an easy way in for someone else. The realistic aim is to satisfy the checks the provider set, which is much easier if you set up recovery options before you needed them.

What you'll need

• Access to your recovery email or phone
• Backup codes (optional)
• A device you have used before (optional)

Step by step

1. Go to the service's website directly and find their account recovery page.Type the address yourself. 'Account recovery' links arriving by email are one of the most common phishing routes.
2. Work out which recovery routes you still control.Recovery email, phone number, backup codes, an authenticator app, or a device already signed in. Any one of these usually suffices.
3. Try from a device and location you normally use.Providers weigh familiar devices, browsers and locations heavily. Recovering from a new device in a new place is much harder.
4. Check whether you are still signed in somewhere.An old phone, tablet or browser still logged in is often the fastest route — change the password from there.
5. Use backup codes if you saved them.This is exactly what they are for. If you have them and cannot find them, check your password manager and any printed notes.
6. Complete the identity form as fully as you can.Approximate creation date, previous passwords, contacts, purchase history. Partial answers frequently fail; thorough ones succeed.
7. Be patient with the process rather than restarting it.Repeated failed attempts can lock the recovery flow for a period. One careful attempt beats five rushed ones.
8. Once back in, fix the recovery options immediately.Current email, current phone, fresh backup codes saved somewhere you will find them, and a new unique password.

Tips

• Your email account is the master key to everything else. Secure it best, and make sure its own recovery options are current.
• Keep backup codes printed on paper somewhere safe. They work when your phone is lost, broken or stolen, which is exactly when you need them.
• If an account was taken over rather than forgotten, check for changed recovery details and forwarding rules once you regain access — attackers add these to keep their access.

Common mistakes

• Following a recovery link from an email — It is a standard phishing tactic. Always navigate to the service's site yourself.
• Only using an authenticator app with no backup codes — A lost or wiped phone then locks you out permanently. Save the codes when you set it up.
• Leaving an old phone number as the recovery contact — Recycled numbers are reissued to new people, who can then receive your recovery codes.

Questions people ask