What Is a Recovery Email? Keeping a Way Back Into Your Accounts

A recovery email is a second address linked to an account so the service can reach you if you are locked out. It receives reset links, verification codes and alerts about unusual activity, but it is not used to sign in and does not get your everyday mail. Keeping it current is one of the simplest pieces of account housekeeping, and one that tends to be remembered only once it is needed.

What a recovery email is used for

• Sending a password reset link or code when you forget a password.
• Delivering security alerts, such as a sign-in from a new device or a change to your settings.
• Helping the service confirm it is really you during an account recovery.

Email providers, social networks, cloud storage and online shops commonly ask for one. It matters most on your main inbox, because that is where nearly every other service sends its reset links. Whoever controls that inbox can reset much of the rest.

Recovery email, recovery phone and backup codes

Two or more of these together give you a route back if one fails. Passkeys also cut down how often a reset is needed at all; our passkey vs password explainer shows how they fit alongside recovery options.

Choosing a good recovery address

• One you will keep. A work or school address vanishes when you leave.
• Not shared. A family inbox that others can open can also be used to reset your account.
• Protected in its own right. Give it a strong, unique password and two-step verification. In effect, it is a spare key to every account that points at it.
• Not circular. Two accounts that list each other as recovery leave you stuck if you lose access to both.

Families often end up helping an older relative with this. If you are supporting someone through a move or a change in living arrangements, updating the recovery details on their key accounts belongs on the same list as redirecting post and changing addresses; our guide to helping an elderly parent move covers the wider plan. Make sure they agree to every change and stay in charge of their own accounts.

How to check and update it

1. Sign in and open the account's Security, Privacy or Account settings.
2. Look for wording such as "Recovery email", "Alternate email" or "Ways we can verify it's you".
3. Check that the address is spelled correctly and still in use. Add one or change it if not.
4. Enter the confirmation code the service sends to the new address.
5. Review the recovery phone number while you are on the same page.

A check whenever you change jobs, phone numbers or email providers stops the details from quietly going stale. It also helps to keep a private note of which address acts as the recovery contact for which account, because that list grows without anyone noticing over the years.

How to know if your email has been hacked

• Your password stops working even though you did not change it.
• Contacts receive messages you never wrote, or they turn up in your Sent folder.
• Security alerts mention sign-ins from places or devices you do not recognise.
• New forwarding rules, filters or automatic replies appear in the settings.
• The recovery email or phone number has been changed to something unfamiliar.

What to do if your email is hacked

1. Go to the provider's official account recovery page by typing its address or using its own app, not through a link in a message. Our guide on checking whether a link is safe explains why.
2. Set a new, unique password and sign out of every other session.
3. Go through recovery email, phone number, forwarding rules and filters, and remove anything you did not add.
4. Turn on two-step verification or add a passkey.
5. Change the password on any other account that used the same one, or that sends its resets to this inbox.
6. Let your contacts know that recent messages from you may have been fake.

Recovery codes by text need a working phone line. Households in the United States on a low income may qualify for a subsidised one; our guide to local phone programmes explains how sign-up works.