You have a long unique password, a security key, and a password manager. Your account is well protected against someone who has your password.
It is also recoverable by anyone who can receive a code at a phone number, or answer where you went to school, or convince a support agent that they are you and have lost their device. That recovery path is your actual security level, and you probably set it up in thirty seconds during signup and never thought about it again.
What changed in 2026
- Passkeys made recovery more prominent. Losing the device holding your passkeys made "how do I get back in" a question more people confronted.
- Voice cloning weakened support-based recovery. Human verification over the phone became a considerably less reliable check — see deepfake scam protection.
- Recovery codes became standard. More services offer downloadable one-time codes as a fallback, which is the most robust option available.
- Account loss stayed catastrophic. With more of life running through a small number of accounts, being locked out remained severe and under-planned-for.
Recovery methods, ranked
| Method |
Attacker difficulty |
Reliability for you |
| Recovery codes, stored offline |
Very high |
High, if you can find them |
| A second security key |
Very high |
High |
| Authenticator app on a backup device |
High |
Good |
| A trusted contact |
Moderate |
Depends on the contact |
| Email to another account |
Depends on that account |
Good |
| SMS to your number |
Low |
Good, until a SIM swap |
| Security questions |
Very low |
Poor — you forget your own answers |
| Support-based identity verification |
Low to moderate |
Slow and inconsistent |
Two rows deserve comment.
Security questions are the worst option available. Your mother's maiden name, your first school, and your first pet are facts, frequently public, and unchangeable once exposed. They are being used as a password that anyone can research. Where a service forces them, the correct approach is to enter random strings and store them in your password manager — treat them as additional passwords, not as questions.
SMS is convenient and fragile. It works reliably and it is defeated by a SIM swap, which is a well-established attack. It is a reasonable last-resort fallback and a poor primary recovery method — see SIM swap protection.
Map the chain
Recovery paths form a dependency graph, and almost all of them lead to the same place.
Most services recover through email. So whoever controls your email controls the accounts that recover through it — which is nearly everything. That makes your email account the single highest-value target and the one deserving the strongest protection you can apply.
Then ask the recursive question: how does your email account recover? If the answer is SMS to a number vulnerable to a swap, then every account in the chain inherits that weakness regardless of how well each is individually protected.
Working through it takes twenty minutes and is genuinely revealing. For your five or ten most important accounts, write down how each recovers, then follow each path to its end. Circular dependencies are the thing to look for — two accounts that recover through each other are both unrecoverable if you lose access to both at once, which is exactly what a lost or stolen phone can cause.
Store recovery codes properly
Recovery codes are the strongest fallback because they depend on nothing — no phone number, no device, no support agent, no company's identity verification process.
They are only useful if you can find them when you need them, and the situation where you need them frequently involves not having your usual devices.
Print them. Paper survives a dead phone, a lost laptop, and a locked password manager.
Store them somewhere physically secure and separate — a safe, a document folder, a safe deposit box. Not a photo on the phone you might lose.
Do not store your password manager's recovery codes inside the password manager. This is the circular dependency people create most often, and it is exactly the case where you need them.
Tell someone they exist. If you are incapacitated, someone needs to know where to look. That overlaps with digital estate planning, which is the same problem on a longer timescale.
Test at least one recovery path. A method you have never used is an assumption. Deliberately log out and recover access to something, once, while nothing is wrong.
Common mistakes
- Truthful security question answers. Public facts used as passwords.
- Password manager recovery codes stored in the password manager. Circular and useless when needed.
- Two accounts recovering through each other. Both lost together.
- SMS as the primary recovery for email. Undermines everything downstream.
- Never testing recovery. Discovering it does not work while locked out.
- Codes only on a device. A dead phone takes them with it.
- Nobody else knowing anything. Incapacity becomes permanent account loss.
FAQ
How many recovery methods should I have?
At least two independent ones for critical accounts, where independent means they do not fail together. A code stored offline plus a backup security key is a good pair. Two methods that both depend on your phone are one method.
What if a service only offers SMS?
Then that is your security level for that account, which is worth knowing when deciding what to keep there. Lock your number down with a carrier port-out PIN, and consider whether a dedicated recovery number that is not public makes sense.
Should I use a trusted contact feature?
Where offered, it is a reasonable additional path, and it depends entirely on that person remaining reachable and reasonably security-aware. Choose someone who will still be findable in five years.
What about biometrics?
They unlock a device rather than recovering an account. If the device is lost, biometrics do not help — which is precisely why a device-independent fallback matters.
Where to go next
For the strongest authentication to protect the accounts at the top of the chain, read security keys explained and the best password managers. For the longer-horizon version of the same problem, digital estate planning.