A recovery address is useful only if you can still open it when the primary account is locked. Choose an address you use regularly but not the address you use to sign in to the account being protected. Secure that mailbox as carefully as the primary account.
Add recovery information before you need it
Google says recovery information can help when you forget a password, someone else uses the account or you are locked out for another reason. You cannot add recovery information while already locked out or in the recovery process, so set it up while normal access works.
- Open the provider through its known app or a typed address.
- Add a recovery email you use regularly and can access independently.
- Confirm the address receives the verification or security message.
- Protect the recovery mailbox with a unique password and its own strong sign-in factor.
- Save a separate recovery method for the recovery mailbox itself.
Know what a recovery email can receive
For Google Accounts, a recovery email can help restore access, report suspicious activity, confirm a username and warn about low storage. Treat unexpected recovery messages as security events: open the account directly instead of following an unverified message link.
Expect a delay after changes
Google may continue sending codes to previous recovery information for seven days after recovery or authentication details change. That delay is designed to help secure the account after an unauthorized change. Review both the new and previous channels during that period and investigate any change you did not make.
If a familiar device or location cannot change recovery information immediately, Google advises trying again from a device and place normally used to sign in, or trying again the following week. Work, school and managed accounts can follow administrator-controlled recovery rules.
Review the dependency twice a year
- Confirm the recovery mailbox opens and receives alerts.
- Remove addresses you no longer control.
- Check that the recovery mailbox does not depend only on the primary account.
- Update the recovery route before changing jobs, providers, domains or phone numbers.
Do not create a circular plan in which each mailbox can be recovered only through the other. Keep at least one independent factor or recovery route outside that pair.
