Secure your email recovery settings before you need them
Review recovery addresses, phone numbers, sign-in methods and forwarding rules so a lost device does not turn into a lost mailbox.
Your email account is often the place other services send password resets. That makes its recovery settings part of the security of your shopping, storage, social and work accounts, not just the inbox itself.
A strong password is useful, but it does not fix a recovery number you stopped using or a backup mailbox you cannot open. Review these settings while you still have normal access and time to make careful changes.
Keep a trusted signed-in device available during the review. There is no benefit in signing out everywhere before you have confirmed that your replacement methods work.
Draw the recovery path on paper
Write down the account name and the methods that can help you regain access. You do not need to write passwords or full recovery codes in this working note.
For example, your main mailbox might rely on a backup email, a phone number and a registered security key. The backup email might, in turn, rely on the same phone. That is a dependency worth noticing before the phone is lost.
Look for loops. If mailbox A can only be recovered through mailbox B, and mailbox B can only be recovered through A, the arrangement may be less useful than it first appears. The goal is at least one practical route you can use without the missing device or inaccessible account.
The recovery-code storage guide helps turn that route into something you can actually retrieve.
Check addresses and numbers you still control
Open the provider's security settings directly. Confirm that each recovery email belongs to you and can receive messages. Check phone numbers digit by digit, including the country code.
Google's recovery documentation explains that available options vary by account and region, and that changes can involve waiting periods or temporary use of previous information. Read the confirmation screens rather than assuming an old method disappears immediately.
Do not use a short-lived number or a temporary mailbox for an account you depend on. A recovery destination should remain under your control over time.
For a work or school address, check the administrator's process. An employer-controlled mailbox may stop being available after a role change, which makes it a poor unexamined recovery dependency for personal services.
Add a replacement before removing the working method
Set up the new method and finish its verification. Check for a confirmation in the account's security screen, not just a message saying the process has started.
Where the service permits it, keep more than one suitable method. A passkey on a phone and an independently stored recovery code solve different problems. Two methods stored only on the same phone may both become unavailable together.
Do a controlled sign-in test on another trusted browser or device while leaving the original session open. Stop if the provider warns that the change is pending. Do not deliberately fail recovery challenges to see how far you can get.
Use the two-factor authentication guide to choose methods that fit your devices and your ability to maintain them.
Review forwarding and mailbox access
Recovery settings are not the only way messages can leave an account. Check automatic forwarding, filtering rules, delegates and connected mail applications.
Gmail's forwarding instructions explain how messages can be sent automatically to another address. Verify that any configured destination is one you recognize and still intend to use.
A rule that archives security messages or forwards selected mail deserves attention even when the account's main forwarding switch looks normal. Check the actual rules rather than assuming a quiet inbox means nothing is happening.
If you find an unfamiliar destination or application, record enough information to understand it, remove unauthorized access and review the account's recent security activity. The connected-app guide covers permissions separately from signed-in device sessions.
Protect the backup mailbox too
A recovery address is not a spare account that can be left with an old reused password. Give it a unique password or an appropriate passkey, review its recovery settings and make sure you know how to access it.
Do not forward all of its recovery mail back into the account it is meant to recover. That can hide the dependency rather than solve it.
Keep the mailbox active under the provider's current rules and check it occasionally for important notices. An address you have forgotten about is not a dependable emergency tool.
If you are changing your main address, follow the email migration checklist rather than editing several interconnected accounts in an unrecorded burst.
Plan for losing the phone and changing the number
Imagine the phone is unavailable and its SIM cannot immediately receive messages. Identify which recovery method you would use first and where you would access it.
You may need a trusted computer, a spare security key or offline instructions to find the provider's recovery page. Keep the instructions separate from secrets where practical. A note that says which sealed envelope contains a recovery code is different from leaving the code on the lock screen.
Before changing a mobile number, update the accounts that use it and complete their confirmation steps. Do not wait until the old number has stopped working to discover which services require a code sent there.
Our lost-phone preparation guide connects these account decisions with device settings and practical contact information.
Know what to do when a change was not yours
An unexpected recovery-change alert is a reason to check the account directly. Do not use a link in a questionable message to start the check.
Review the provider's recent security events, active sessions and registered sign-in methods. Change a compromised password from a trusted device and remove access you do not recognize. Follow the provider's recovery or account-compromise process if normal access has already been lost.
Avoid paying strangers who claim they can bypass an account provider's recovery checks. A request for passwords, session cookies or verification codes is not a legitimate shortcut.
When the review is finished, keep a short record of which methods are active and when you checked them. Do not turn it into a document full of passwords. The useful result is a mailbox with current recovery routes, recognized access and a plan that still works when one device is missing.
Sources and further reading
- Google Account Help: Set up recovery options Consulted 28 September 2026.
- Gmail Help: Automatically forward messages Consulted 28 September 2026.
Consult the linked documentation for current details. Settings, availability and interface labels may change.
Spotted something that needs correcting? Send a correction with this article’s title and the relevant source.