Why Your Account Needs a Recovery Plan Before It Needs Anything Else

Nobody plans to lose access to an account. The phone gets stolen, the authenticator app disappears with a broken screen, the recovery email belongs to a job you left two years ago, the password manager vault will not open because its own recovery key is on the laptop that was just wiped. Each of these is an ordinary event on its own. Together they are the reason a recovery plan exists: a short, written record of how you get back in, made while everything still works.

Most people discover they need one at the worst possible moment — locked out, under pressure, trying to remember details they set up years ago while a platform's support form asks for information they no longer have. The stress of the lockout makes every decision harder, and the longer you are locked out, the more likely you are to take a shortcut that makes things worse, like creating a second account, reusing a weak password, or handing your details to someone who promises to fix it for you.

A recovery plan removes the thinking from the emergency. It is a single document that answers four questions for every account you care about: how do I prove this account is mine, where are the recovery details, what do I do first if I am locked out, and who can help me if I am stuck. Writing it takes less than an hour, it costs nothing, and it turns a crisis into a checklist. This guide walks through what to include, where to keep it, and how to make sure it still works when you need it.

A recovery plan is not a backup of your passwords, and it is not a second copy of your account. It is a map of the way back in. For each account it records the recovery path the platform offers — the recovery email, the phone number, the authenticator setup, the backup codes, the identity documents the platform has on file — and the order in which you would use them. If the first path fails, the plan tells you the second one, and if that fails, the third.

The plan also records what you would need to prove ownership if the automated paths all fail. Platforms ask for different things — a photo of an identity document, answers to security questions, details of recent transactions, the date the account was created — and the plan notes which of these you can actually provide. That matters because the details people forget first are exactly the ones support teams ask for: the original signup email, the approximate creation date, the last few transactions. Writing them down now, while you can still look them up, saves a painful guessing game later.

Keep the plan separate from the accounts it describes. A plan stored inside the email account it is meant to recover is no plan at all, and a plan on a device you have lost is just as useless. The guide at /blog/building-a-simple-account-register-your-future-self-will-thank-you-for covers the same idea from a different angle: a register keeps track of what you own, while a recovery plan keeps track of how to get it back. The two documents work best together.

First, the recovery contact for each account: the recovery email address and phone number the platform has on file, and whether you can still reach them. A recovery email you stopped using years ago is the most common single point of failure, and it is invisible until the day you need it. The post at /blog/recovery-email-hygiene-the-inbox-behind-the-account-matters explains how to check that the inbox behind an account is still healthy — the plan simply records the result of that check so you do not have to rediscover it during a lockout.

Second, the two-factor setup: which method each account uses, where the authenticator lives, and where the backup or recovery codes are stored. If you use an authenticator app, note which device it is on and whether the codes were ever backed up. The guide at /blog/two-factor-everything-setting-up-2fa-before-your-first-transaction explains how to set this up properly; the plan records the setup you actually have, including the uncomfortable truth if a code was never saved.

Third, the documents: which identity document the platform verified, when it expires, and where the physical or digital copy is kept. Fourth, the account's own history: the original signup email, the approximate creation date, and the kind of activity the platform would recognise as yours. Fifth, the support route: the platform's help centre link, the account recovery form, and any case reference format it uses, so you are not searching for the right page while locked out.

A recovery plan has to survive the very event it is written for. That rules out most of the convenient places. Do not store it only on the phone it describes recovering, only in the email account it describes recovering, or only on a laptop that could be stolen, wiped or broken on the same day you lose access. The plan needs to live somewhere the problem cannot reach.

The simplest setup that actually works is two copies in two different places: one printed copy kept somewhere secure at home, and one encrypted digital copy somewhere you can reach from any device — a password manager's secure notes, an encrypted drive, or a trusted person's safekeeping, depending on what you are comfortable with. The printed copy matters because the most common lockout involves losing the one device that holds everything else. Paper does not need a battery, a password or a network connection.

Whatever you choose, write down where the copies are, inside the plan itself — and tell one trusted person that the plan exists and where to find it. A plan nobody else knows about is no help if you are the one who cannot reach it. Keep the plan itself free of passwords where possible: it should describe the way back in, not hand over the keys. Passwords belong in a password manager; the plan records how the manager itself is recovered, which is a detail the guide at /blog/how-to-rotate-passwords-across-a-portfolio-without-locking-yourself-out touches on when it covers keeping access to a whole portfolio at once.

A plan you have never tested is a guess, and guesses fail under pressure. Testing does not mean locking yourself out on purpose. It means walking through each step on paper and confirming the pieces are real: can you open the recovery inbox, is the phone number still yours, does the authenticator app still generate codes, can you find the backup codes in the place the plan says they are.

Do this once when you first write the plan, and again whenever something changes — a new phone, a new email address, a document renewal. The most useful test is the smallest one: pick one account, follow the plan's first step exactly as written, and see whether it works. If a step is wrong, fix the plan, not your memory of it. The plan is the record; if it does not match reality, reality wins and the plan is wrong.

A good habit is to tie the test to a routine you already keep. The post at /blog/the-weekly-15-minute-account-health-check describes a short weekly look at logins, recovery details and documents — folding a quick plan check into that routine means the plan is re-tested every few weeks without any extra effort. A plan that is checked regularly stays honest; a plan written once and filed away quietly goes stale.

When a lockout or a suspicious alert happens, the plan's first job is to slow you down. The most damaging mistakes happen in the first hour: clicking a link in a panic, handing credentials to a stranger who offers to help, or resetting things in the wrong order and locking the recovery path itself. Open the plan, read the first step, and follow it. That is the whole point of writing it down in advance.

Work the steps in order. Start with the recovery path the plan lists first — usually the recovery email or phone — and only move to the next one when the first has clearly failed. While you wait for codes or replies, check the sessions list and sign out anything you do not recognise. The post at /blog/what-to-do-in-the-first-hour-after-a-security-alert walks through those first steps in detail, and it is worth reading before you need it rather than during a real incident.

If the automated paths all fail, the plan tells you what to send to support: the documents, the dates and the details that prove the account is yours. Expect the process to take time, and keep a note of every case number, every reply and every step you tried. If a platform asks for documents again as part of the process, the post at /blog/when-platforms-ask-for-documents-again-handling-re-verification-calmly explains how to handle that calmly. The plan keeps you from starting over each time you talk to support, because everything you have already tried is written down.

A recovery plan is a living document, and its worst enemy is a quiet change you forgot to record. You changed phones and the authenticator never moved across. You closed an old email address and forgot it was the recovery address for three accounts. A document expired and was replaced with a new number. Each change is small; together they are how a plan goes stale.

The fix is a short review every few months: open the plan, check each recovery contact, each authenticator, each expiry date, and update anything that moved. Tie it to something you already do — the start of a season, a calendar reminder, or the weekly check routine — so it happens without willpower. A plan reviewed four times a year is a plan you can trust; a plan reviewed never is a plan you hope about.

Start today, even if the plan is imperfect. A one-page plan that covers your two most important accounts is worth far more than a perfect plan you never write. List the recovery contacts, the two-factor setup, the documents and the support route for those two accounts, store the plan somewhere the problem cannot reach, and test the first step. Then add the next account next week. Within a month you will have a record that turns the worst day with an account into an ordinary afternoon of following steps.

This article is educational information about managing verified accounts. It is not financial, legal or tax advice, and it is not a recommendation to buy or sell any account. Platform features, limits and verification requirements differ and change over time, so check the current settings and rules of each platform you use before you act.