An account recovery plan should list critical accounts, verify each provider's current recovery methods, keep backup access separate from the primary device, and name the first actions for loss or compromise. Build and test the plan while you can still sign in; never store live passwords or verification codes in the checklist.
Inventory the accounts that matter most
Begin with the email account that receives resets, the password manager, mobile carrier, financial services, cloud storage, and any administrator accounts. Record the provider, account identifier, recovery email or phone in masked form, multi-factor method, backup method, and official support URL. Do not include the password, full recovery codes, or answers to security questions.
Rank accounts by dependency. If every other account sends recovery messages to one mailbox, that mailbox needs the strongest protection and more than one reliable recovery option. Work and school accounts may use an administrator-controlled process, so record the help desk or administrator rather than assuming a consumer recovery page applies.
Verify recovery information and backups
Google explains that recovery information can help users regain access, block unauthorized use, prove ownership, and receive suspicious-activity notices. Its recovery options guide also notes that changes may not always be immediately available from an unfamiliar device or location. Review each provider's actual security page instead of relying on an old screenshot.
Add a recovery email that is itself protected, confirm phone ownership, and remove obsolete addresses or numbers. If the provider offers backup codes, print or store them securely away from the everyday device. Keep a spare physical authenticator in a secure place when the risk and provider support justify it.
Strengthen the primary sign-in
Use a unique password and enable multi-factor authentication. CISA recommends turning on MFA for every account or application that offers it because the extra step can prevent access even when a password is stolen. See CISA's MFA guidance. Prefer the strongest method that the provider and your devices support, and understand any fallback method that remains enabled.
The recovery path must not silently become the weakest sign-in route. Protect the mobile carrier account, keep device screen locks enabled, and review trusted devices or sessions. Do not give a code to someone who contacts you; enter it only in the provider's official sign-in flow that you opened yourself.
Run a safe recovery drill
A drill should confirm access to the recovery email, possession of the registered phone or key, the location of backup codes, and the official recovery URL. Do not intentionally lock yourself out or reset a functioning password merely to prove the process. For organization accounts, confirm who can approve recovery and what identity evidence is required.
Record the review date and any gap, such as one missing backup method or an old phone number. Set a recurring review after device changes, moves, job changes, or family transitions. If an account is already compromised, stop the drill and follow the provider's incident-recovery instructions from a trusted device. The plan is complete when it has current routes, independent backups, and no secret values exposed in the inventory.
Sources
- Set up recovery options — Google
- Turn On MFA — Cybersecurity and Infrastructure Security Agency