Your Recovery Email Is the Master Key — Protect It First

Every account you own has a back door: the address a password reset is sent to. Whoever controls that address can walk into your primary email, and from there into your bank, your cloud storage, your social accounts and anything else that resets by email. The recovery address is not one account among many — it sits above all of them.

Most people have never checked which address that even is.

The audit: thirty minutes, once

1. List the accounts that matter — primary email, bank, password manager, phone carrier, Apple/Google account, government services, work, domain registrar, anything tied to income.
2. For each one, open the security settings and read the recovery address and recovery phone.
3. Look for the dead ones. This is the most common serious finding: a university address that was deactivated, an old work account, an ISP mailbox you stopped paying for, an address at a domain you let expire. A recovery address you no longer control is a door with a key in the lock — and if someone else registers that domain or the provider recycles the username, it becomes their door.
4. Fix them one at a time, starting with the accounts that unlock others.

The setup that closes the chain

• A dedicated recovery mailbox that you never use publicly. No newsletters, no sign-ups, no correspondence. Nothing points at it, so nothing leaks it.
• A unique, strong password stored in your password manager — never a variant of another password, because reusing a password turns one breach into a hundred.
• App-based two-factor authentication, not SMS where you can avoid it: SMS 2FA is better than nothing and worse than an app.
• Printed backup codes, stored offline — otherwise you have swapped one lockout risk for another: store your 2FA recovery codes offline.
• No forwarding rules. A forwarding rule quietly added by an attacker is how a single compromise stays useful for months. Check the rules and the connected apps in that mailbox every few months.
• Log in quarterly. Some providers delete inactive accounts, and a deleted recovery address is the dead-address problem all over again.

Watch the phone number too

A recovery phone number is a second master key, and it is weaker than it looks: SIM-swap fraud — persuading or bribing a carrier to move your number to a new SIM — is an industrialised attack. Where a service allows it, remove SMS as a recovery method once you have an authenticator and codes. Ask your carrier for a port-out PIN or account lock; most offer one and almost nobody asks.

And remember the rule that ends most of these attacks: never share a verification code with anyone, including someone claiming to be support.

What an attack actually looks like

It is rarely password cracking. It is: your old address is compromised or recycled → they request a reset on your primary email → they hold your primary email → they reset the bank, the marketplace, the crypto wallet, the domain → they add their own recovery address and remove yours. The whole chain takes minutes, and the first thing you notice is a login you cannot complete.

Every step of that depends on where the reset mail lands.

Frequent questions

Can I use my partner's or parent's email as recovery? No. Their security becomes yours, and a shared inbox has a way of becoming an ex's inbox. Use a mailbox you alone control.

Is a second Gmail as recovery for the first Gmail acceptable? Better than a dead address, weaker than a different provider — a single provider outage or account-level suspension can take both at once.

How do I know if my address has already been in a breach? Check it against a breach database and act on what comes back: check haveibeenpwned for leaks.

I do not use a password manager yet. Start there — this whole plan assumes unique passwords you do not have to remember: why you need a password manager.

What if my recovery mailbox is already compromised? Assume everything downstream is exposed: change its password from a device you trust, revoke sessions and app passwords, delete unknown forwarding rules and filters, then work through the accounts that use it, starting with money and identity.