When Was the Last Time You Checked Your Account Recovery Information?

Introduction

What do you do when you forget your password?

Maybe it’s no big deal. You click Forgot Password, receive a code, create a new password, and quickly get back inside your account.

Have you ever thought about how you get that recovery code?

Maybe it’s sent to your current phone…but maybe it’s going to an email address you created 12 years ago. Perhaps it’s connected to a number you haven’t used since you got your last phone.

We spend a lot of time protecting passwords, but your account recovery information can be just as important. After all, if someone can use it to reset your password, they may not need to know your credentials in the first place.

Account Recovery Is Your Backup Key

Most major online accounts offer other ways to prove your identity if you get locked out. That might include a recovery email address, phone number, backup codes, security questions, or another trusted device.

These features are extremely useful. Unfortunately, they can also create problems when we set them up and then completely forget about them.

Think of your recovery method as the spare key to your house. You probably wouldn’t protect your front-door key and then leave the spare sitting out on the sidewalk. Your online accounts deserve the same consideration!

Old Email Addresses Can Become a Problem

Maybe you created your primary email account years ago and connected your old college, work, or personal email address as the recovery option.

Do you still have access?

More importantly, is it still secure?

If an old email account has a weak or reused password, someone who compromises it may use password-reset features to target other accounts connected to that same address. Your main account could have an incredibly strong password and multi-factor authentication, but the forgotten recovery account might not.

Sometimes the weakest part of an account isn’t the front door, but the backup entrance you forgot existed.

Your Old Phone Number Matters Too

Phone numbers don’t necessarily belong to us forever. People change carriers, move, get new numbers, or let old ones go. Eventually, a phone company may assign an unused number to somebody else.

That becomes a problem if the old number is still connected to your accounts!

Imagine requesting a password-reset code only to discover it’s being sent to a phone number you haven’t had in three years. Now imagine somebody else has that number.

That doesn’t automatically mean they can access your account, but it’s certainly not information you want to send to a stranger.

Whenever your phone number changes, remember to update your important accounts, too.

Don’t Forget About Security Questions

Remember questions like:

• What was your first car?

• What is your mother’s maiden name?

• What was the name of your first pet?

Security questions used to be everywhere, and some websites still use them for recovery. Unfortunately, those answers may not be particularly secret. Social media profiles, public records, old posts, and casual conversations can reveal surprising amounts of personal information, and that information can help threat actors guess their way into your accounts.

If a profile still relies on security questions, treat those answers like your passwords. Don’t choose information someone could easily find by scrolling through your social media profile.

Take Five Minutes and Check

You don’t need to inspect every account you’ve created since you first went online. Start with the most important ones.

Check your primary email account, banking and financial accounts, social media, cloud storage, and any account containing sensitive personal or work information. Review the recovery email address and phone number associated with each. Ask yourself:

• Do you still control them?

• Are they protected?

• Do you recognize everything?

While you’re there, enable multi-factor authentication and save any backup recovery codes somewhere secure.

For work accounts, follow your organization’s recovery procedures instead of adding unapproved personal recovery methods.

Conclusion

A strong password protects your normal access to your account. Your recovery information protects what happens when that password doesn’t work. Both deserve your full attention.

Take a few minutes today to check where your password-reset emails and security codes would actually go. You don’t want to discover your recovery information is outdated when you’re locked out of an account.

Even worse, you don’t want someone else discovering it first.