Account Recovery: What to Do If You Lose Access

The worst moment to work out how account recovery functions is the moment you need it. This guide covers the four situations people find themselves in, the order to do things in when someone else is inside your account, and the one route that turns a bad day into a much worse one.

Step 1 — Work out which situation you are in

The four cases look similar from the inside and need different responses.

Step 2 — Start from inside, never from a search

This is the step that protects you from making things dramatically worse, and it deserves a section of its own.

Searching for a company’s support number produces paid adverts and optimised pages, and a persistent share of those are fraudulent. The people who answer are practised, patient and completely convincing. They will ask you to install a remote-access app, to read out a verification code, or to pay a "recovery fee". Every one of those requests is the fraud, not the fix.

• Open the service’s own app or type its address directly, and use the help section inside it.
• For a bank, use the number printed on your card or on a statement — never one from a search.
• Real support never asks for a verification code, your password, or remote control of your device.
• No legitimate service charges a fee to restore an account.

Step 3 — Make it easy for the service to recognise you

Automated recovery is largely a confidence calculation. Small things tilt it, and most people accidentally do the opposite of all of them.

1. Use a device you have used before, on your usual network, from your usual location. A recovery attempt from a new device on a foreign network is the exact pattern an attacker produces.
2. Use the same browser you normally use, not a private window.
3. Answer from memory rather than guessing repeatedly. Several wrong attempts can lower your score or lock the process.
4. Be precise on details. Roughly when the account was created, the original email address on it, a recent purchase or contact. Accuracy counts more than volume.
5. If a form invites free text, describe verifiable specifics, not the situation or how urgent it is.

Step 4 — If someone else is already inside

Here the order genuinely matters. Changing the password first is the instinct, and it is the wrong first move — if they still control the email, they simply reset it back.

1. Secure the email account first, and only then anything else. Everything resets through email, so it has to be yours before the rest of the work sticks.
2. Sign out all other sessions, from the account’s security or devices page. Otherwise a session they already hold survives a password change.
3. Then change the password, to something not used anywhere else.
4. Then re-check recovery settings. People who take over accounts add their own recovery email, phone number or app password. A new password is worth nothing if a route they added is still in place.
5. Turn two-step verification on, or off and on again if you suspect it was altered.
6. Tell your contacts. The usual next step is messaging the people who trust you, asking for money in your name.
7. Check connected apps and forwarding rules, especially on email, where a quiet forwarding rule can outlast everything else you just did.

Step 5 — Avoid recovery services entirely

Accounts marketed as recovery specialists, and people who appear in your messages offering to restore access for a fee, are a category rather than a coincidence.

• They cannot do anything you cannot do. There is no back channel into a major platform.
• They often find you — a reply under your public post asking for help is the standard approach.
• Paying identifies you as someone who pays, and is commonly followed by a second request.
• People who have already lost money are targeted again by this exact offer. If you have been defrauded once, expect it.

Step 6 — Set recovery up properly before you need it

Fifteen minutes now removes most of the difficulty later. Do this on your email account first.

1. Add a recovery email you still control, and check it actually works rather than assuming.
2. Add a recovery phone number that is current. An old number is worse than none, because it may now belong to someone else.
3. Download and store the backup codes somewhere independent of your phone.
4. Register a second verification method, so one lost device is not a lockout.
5. Review the devices list on your main accounts and remove anything you no longer own.
6. Note the account creation date for your main email somewhere safe. Recovery forms ask, and almost nobody remembers.

Common questions

The six steps in one place

• Identify which of the four situations you are actually in.
• Start inside the service’s own app, never from a search result or an advert.
• Recover from a familiar device, network and browser, and answer precisely.
• If taken over: email, sessions, password, recovery settings — in that order.
• Never pay a recovery service. They can do nothing you cannot.
• Set recovery up in advance, starting with your email account.