Account Recovery Security

A recovery address is an alternate login. Whoever controls that mailbox can often request a reset for the primary account. If the recovery mail is an old school account you lost, you are one forgotten password from permanent lockout — and if that old inbox is weakly protected, an attacker is one stuffing hit from owning you. Use a mailbox you still control, with unique password and 2FA from the last two lessons. The recovery phone has the same shape as SMS 2FA: it is a carrier account. Number-port risk applies. For high-value targets, prefer email + TOTP + offline codes over SMS-only recovery. Do not publish the recovery address on social bios.

Backup codes are single-use passwords generated at 2FA setup. Offline means: printed sheet in a place you control, or a secure note inside the password manager vault — not a draft in the mailbox you are protecting, not a photo in an unlocked camera roll synced to the cloud, not a Discord DM to yourself. If the inbox is compromised, codes in that inbox are already in the attacker's have pile. Print once, confirm you can read the print, then store the paper. When you rotate 2FA, destroy the old sheet and print the new one. Spare hardware keys follow the same idea: one on the keychain, one offline, both enrolled on accounts you own.

Security questions fail because they ask for public-data facts: maiden names, first school, pet, city of birth — exactly the active footprint from Module 1. Treat answers as random secrets stored in the manager, not as truth. If the site rejects "random," still pick something that is not on your public profiles, and store it. Questions are a legacy know factor. They are not 2FA. Combining weak questions with SMS recovery on an account that also has a stuffed password is how "I had 2FA" still loses the mailbox.

Real support will not DM you for a 2FA code, password, or backup-code photo. Anyone who asks is running recovery against you. Bookmark official recovery URLs before you need them. When you are locked out, use those URLs from a browser you trust — not a link in a panic email. Document account IDs for banking and mail in the same offline kit as the codes. Device upgrades belong in this plan: move TOTP or add a second method before you wipe a phone. A recovery story that starts after the wipe is how people lose vaults.

Balance is the point. Zero recovery means a dead handset is exile. Recovery that is easier than login means the attacker skips login. The design you want: strong unique password, TOTP or key, backup codes offline, recovery mailbox equally hardened, phone as last resort, questions as stored randomness. You will not achieve that on every forum. You will achieve it on email and the manager — the hubs.

If you enrolled TOTP in the last lesson, those codes may already exist under Security → Backup codes. If not, generate them there. Paper or vault — pick one you will actually keep. Do not upload the file to a public drive. Do not photograph it onto an unlocked phone home screen.

You now treat recovery as attack surface: hardened recovery mail, offline backup codes, random security answers, no codes in the protected inbox, official support only. Next — Quiz — Secure Your Accounts — ten APPLY scenarios on managers, stuffing, 2FA quality, and recovery kits. After that, Module 3 opens with Browser Privacy, where the client you already used for cookies becomes a daily control plane.