Planning account recovery before you need it

The stronger an account’s sign-in protection, the more its owner depends on recovery options when something goes wrong: a phone is lost or replaced, a password is forgotten, or someone else gets in and changes the details. Account recovery is set up in each account’s security settings, by adding a current recovery phone and email, saving backup or recovery codes and, for Apple, choosing a recovery contact, and it is much easier to do while you still have access than to sort out after you’ve been locked out.

This guide explains how to set up account recovery: the main recovery tools (recovery phone numbers and emails, backup codes, recovery codes and recovery contacts), and the steps for Google, Microsoft and Apple accounts. The Multi-factor Authentication Checklist covers the sign-in side.

Why it matters

Multi-factor authentication (MFA) is designed to stop someone who only has your password. That cuts both ways. If you lose the phone that receives your codes, the password alone may not be enough for you either. The guide to securing online accounts with MFA explains how the second step works.

Microsoft spells this out on its two-step verification page: with two-step verification on, “if you lose your contact method, your password alone won’t get you back into your account”, and “it can take you 30 days to regain access.” Microsoft says it “strongly recommend[s]” having “three pieces of security info” associated with a Microsoft account, “just in case.”

The main recovery tools

• Recovery phone number. A mobile number the service can text a code to.
• Recovery email address. A second email address, used to send reset links or alerts.
• Backup codes or recovery codes. One-time codes you save in advance, for when your phone isn’t available.
• Recovery contact. A trusted person who can help confirm it’s you (offered by Apple).
• A second security key or synced passkeys. So losing one device doesn’t lock you out. See how hardware security keys work.

Which accounts to start with

The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) lists accounts by importance in its MFA guide: email first, then financial services, accounts that save payment details, social media, and other accounts holding personal information. It explains that “a cybercriminal with access to your email accounts can reset passwords for your other accounts.” The same logic applies in reverse: your main email account is usually how you recover everything else.

The ACSC’s MFA guide also says recovery email addresses should be kept up to date and be at least as secure as the main account. A recovery address with a weak, reused password is a back door.

How to set a recovery phone and email for a Google Account

Based on Google’s instructions (checked October 2026). Menus can change; Google’s guide has the latest steps.

1. Go to myaccount.google.com and sign in.
2. Open Security & sign-in.
3. Under How you sign in to Google, select Recovery phone.
4. Follow the on-screen prompts to add a number, or select Edit or Delete beside an existing number to change or remove it.
5. Go back and select Recovery email, then add, edit or delete the address the same way.

Google describes using “a mobile phone that gets text messages, belongs only to you, and that you use regularly and keep with you”, and choosing “an email address you use regularly but not the one you use to sign in to your Google Account”. For recovery phone changes, Google says “it may take up to 7 days for those changes to take effect.”

How to get and store Google backup codes

Based on Google’s instructions (checked October 2026). Google’s guide has the latest steps. Backup codes need 2-Step Verification to be on.

1. Open your Google Account and go to Security & sign-in.
2. Under How you sign in to Google, select 2-Step Verification. You may need to sign in again.
3. Under Backup codes, select Continue.
4. Select Get backup codes to create a set of 10 codes (or Refresh to replace an existing set).
5. Print or download them, and store them somewhere secure. Google gives the example of keeping them with a passport or other important documents.

Google explains that each code works once, and “When you create a new set of codes, the old set automatically becomes inactive.” It says: “Do not share your backup codes with anyone.”

How to create a Microsoft account recovery code

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide has the latest steps.

1. Sign in and open the Manage how I sign in page of your Microsoft account security settings (account.live.com/proofs/manage/additional).
2. Scroll to the Recovery code section and select Generate a new code.
3. Print the code and store it somewhere safe.

Microsoft says: “As soon as you create a new recovery code, any previous codes will no longer work.” It also says: “You cannot retrieve or download an existing Microsoft account recovery code”, so a lost code means generating a new one while you can still sign in. Microsoft adds: “For security, do not store the code on a device used to sign in to your account.”

How to add an Apple account recovery contact

Based on Apple’s instructions (checked October 2026). Apple’s guide has the latest steps and requirements, including software versions.

1. On iPhone or iPad, open Settings and tap your name.
2. Tap Sign-In & Security, then Recovery Contacts.
3. Tap Add Recovery Contact and follow the on-screen steps.
4. Choose a suggested contact, or tap Choose Someone Else.
5. The person accepts the invitation in Messages. On a Mac, the same option is in System Settings > your name > Sign-In & Security > Recovery Contacts.

Apple’s page lists the requirements, including up to five recovery contacts, recent software on both people’s devices, and iMessage turned on.

Apple says a recovery contact “should be a person that you know and trust”, and that “Your recovery contacts won’t have any access to your account, only the ability to give you a code.” Apple also says it doesn’t know who your recovery contacts are, so the account owner has to remember who they are.

Apple’s recovery key (optional, with a warning)

Apple also offers a 28-character recovery key. Its recovery key page says: “When you set up a recovery key, you turn off Apple’s standard account recovery process.” Apple warns that someone who loses the key and can’t provide it could be “locked out of your account permanently.” Apple says: “Don’t store your recovery key in your Apple Passwords app, iCloud Photos, Notes, or iCloud Drive.” This makes a recovery key a significant decision, and Apple’s page describes it in full.

How to prepare for changing or losing a phone

The ACSC’s MFA guide describes several preparations:

• moving an authenticator app to a new phone “before disposing of, or resetting, the old one”, noting some services may need MFA turned off and on again
• updating sign-in options that use text-message codes “before you lose access to your old phone number”
• saving backup codes “in case you lose access to your authenticator app”.

The guide to setting up a new phone securely covers the rest of the move to a new phone.

For passkeys and security keys, the ACSC’s passkeys page says: “It is recommended to create and store a backup passkey on a second FIDO2 security key.” Synced passkeys are copied to your other signed-in devices, so losing one device doesn’t remove them. See how passkeys work and what to do about a lost or stolen phone.

Things to watch for

• An old phone number or email. Out-of-date details can stop recovery working without anyone noticing. Google, Microsoft and Apple all let you review them in account settings.
• Codes stored only on the phone. Backup codes saved in a phone’s notes app don’t help when the phone is lost.
• Recovery details changed without your knowledge. The ACSC’s email attacks guide lists “Update your account recovery details” among its steps, along with checking forwarding rules and unfamiliar connected apps.
• Fake “account recovery” messages. Scamwatch’s phishing page says scammers can make messages look like they come from real organisations, and describes contacting organisations using “contact details you’ve found yourself.”
• Paid “recovery” offers. Scamwatch’s money recovery scams page says scammers “contact people that have already been scammed and had money stolen and offer to help them get their money back.” It says: “Never give strangers your personal details or remote access to your devices.”

Common questions

How do I set up account recovery?

Account recovery is set up while you still have access, usually starting with the main email account. The ACSC lists email first because a criminal with access to it can reset passwords for other accounts. The main tools are a current recovery phone and email, backup or recovery codes kept away from the phone, and, for Apple, a recovery contact. The steps for Google, Microsoft and Apple are above.

What do I do if I lose the phone I use for two-step verification?

Backup codes, recovery codes and up-to-date recovery details are what this situation calls for. Microsoft says that with two-step verification on, “if you lose your contact method, your password alone won’t get you back into your account”, and that regaining access can take 30 days. The ACSC’s MFA guide describes saving backup codes “in case you lose access to your authenticator app”. The guide to a lost or stolen phone covers locking and erasing the phone itself.

Are backup codes the same as recovery codes?

They do similar jobs but work differently. Google’s backup codes are a set of 10 single-use codes that stand in for the second sign-in step, and a new set cancels the old one. Microsoft’s recovery code is a single code for getting back into the account. Microsoft says an existing code can’t be retrieved, so a lost one means generating a new one while you can still sign in. See Google’s steps and Microsoft’s steps.

Where do I keep my backup codes?

Somewhere secure that isn’t the device you sign in with. Google says to store backup codes somewhere secure, gives the example of keeping them with a passport or other important documents, and says not to share them. Microsoft says not to store its recovery code on a device used to sign in. Codes saved only in a phone’s notes app don’t help when the phone is lost. More in Things to watch for.

Can a recovery contact get into my Apple Account?

No. Apple says recovery contacts “won’t have any access to your account, only the ability to give you a code.” Apple describes a recovery contact as “a person that you know and trust”, allows up to five, and says it doesn’t know who your recovery contacts are, so the account owner has to remember them. The Apple recovery contact steps cover setting one up on iPhone, iPad or Mac.

Is it a scam if someone offers to recover my account or money for a fee?

Scamwatch lists it as a warning sign. Its money recovery scams page says scammers “contact people that have already been scammed and had money stolen and offer to help them get their money back”, names offers to “recover stolen money for a fee” as a warning sign, and says: “Never accept offers from anyone who says they can get your money back.” See how money recovery scams work.

Where to get official help

• If an account has already been taken over, see what to do if an account has been hacked.
• The ACSC’s cybercrime help page has ReportCyber and the 24/7 hotline, 1300 CYBER1 (1300 292 371).
• Scamwatch’s money recovery scams page describes IDCARE as “Australia and New Zealand’s national identity and cyber support service” and says it can help make a plan, free of charge, to limit the damage (1800 595 160).
• If money is involved, Scamwatch’s first step is to “Contact your bank or card provider immediately to report the scam”. See what to do first after a scam.