Choose one account you use and are authorized to manage. While access is normal, find its official recovery instructions and ask: could I start this process without the phone or computer I am using now? A private note with the provider’s name and recovery route is enough to start. Unknown details can stay blank; you do not need to change settings, buy a security key, or make a list of every password tonight.

A password is only part of access. The provider might also require an inbox, phone number, trusted device, second factor, identity check, or administrator. The useful gap to find is a recovery route that depends entirely on the device you might lose.

This checklist is for ordinary preparation with your own authorized accounts, not bypassing someone else’s account, device lock, organizational controls, or legal authority. If a device is already lost or an account may be compromised, urgent safety, care, bank reporting, and managed-device support come before this exercise.

Two closed notebooks, a pen, an open zippered organizer holding plain papers and a card, and a file box on a wooden desk beside a lamp and plant.
A private recovery note can point you to the provider without exposing the secrets needed to sign in.

Protect the accounts that reset everything else

Start with the account that matters to your actual task. Email used for resets is worth protecting, but the list below is not a mandatory incident-response order:

  1. primary email used for resets;
  2. password manager or credential vault;
  3. mobile carrier account and phone number;
  4. device-platform account;
  5. financial and payment accounts;
  6. work, school, health, insurance, and government services;
  7. cloud storage and backups;
  8. communication and social accounts that could impersonate the owner.

You can note one dependency without drawing the whole household system. For example, if email recovery requires the missing phone, that is a gap to ask the provider about. Record provider names and method types privately, not passwords or live codes. A general note does not give another person permission to access the account.

Complete the recovery checklist while access is normal

For the one account you chose, review the information you can safely see during normal authorized access:

  • confirm the recovery email belongs to the household, is still accessible, and is protected independently;
  • confirm the recovery phone number is current;
  • note an unfamiliar method, device, session, or forwarding rule and use the provider’s security guidance if it suggests compromise;
  • check which MFA and alternative recovery options the provider offers;
  • read the provider’s instructions before generating or replacing backup codes, registering a factor, or changing a recovery contact;
  • understand whether generating new backup codes invalidates old ones;
  • record the official account-recovery starting point without copying the secret into the same map;
  • note whether an employer, school, family organizer, or service administrator controls recovery;
  • review alerts and notifications so a recovery change will be noticed.

These are review questions, not instructions to remove settings or rotate secrets as a drill. Changes may invalidate existing codes or access. Do not sign out, disable the account, remove the only working factor, or overwrite necessary recovery material to test the plan. Follow the provider’s instructions for the exact account before any change; use the administrator for a managed account.

Use a password manager without creating a new single point of failure

NIST recommends password managers for accounts that still use passwords and stresses protection of the manager’s own login. You do not need to migrate accounts to start a recovery note. If you are evaluating a manager, ask:

  • how the vault is encrypted and synchronized;
  • which devices and operating systems are supported;
  • whether MFA is available for the vault;
  • how emergency or family access works;
  • what happens if the master credential is forgotten;
  • what recovery requires and what the provider cannot recover;
  • whether a local vault needs its own backup schedule;
  • whether an export would expose plaintext secrets and how the official migration process protects necessary originals and temporary copies;
  • how you would begin recovery alone, or through a permitted helper or administrator.

Do not assume every password manager can or should recover the master password. A design that prevents provider recovery may improve confidentiality while increasing lockout risk. Document that tradeoff before adoption. Never put the only vault-recovery secret inside the vault it unlocks.

Check what still works without this phone

Authentication and recovery are not the same thing. A secure sign-in method on one phone may still be unavailable when that phone is gone. Check the exact service’s options rather than assuming an extra device or code always works.

Recovery options to check with the provider
OptionQuestion, not a guarantee
Authenticator or passkeyWhat happens if this device is unavailable? Backup and synchronization behavior varies.
Another device or security keyIs it actually registered and permitted for this account? Do not buy one on an assumption.
Backup codesAre they supported, current, single-use, or replaced by new codes? Keep their values separately protected.
Recovery email or phoneCan I access it independently, and is it still mine?
Contact or administratorWhat may this person do, and what verification or policy applies?

The exact hierarchy is provider-specific. A security key that works for one account may not replace a phone for another. A recovery contact may help reset an account without seeing its contents. Read the current official instructions before recording assumptions.

Create an offline recovery map

The map may include:

  • account purpose and provider;
  • a general account-purpose clue; keep identifiers in protected records;
  • official support or recovery route;
  • factors enrolled, described by type rather than secret value;
  • location category for sealed backup codes or keys;
  • trusted contact or administrator role;
  • last review date;
  • what should happen if the phone number changes;
  • what must be revoked after a device is lost.

Keep passwords, full or partial account/policy/member identifiers, private keys, seed phrases, backup codes, and precise secret locations out of a broadly shared note. Necessary original recovery material belongs in separately protected storage, not a site form or email. Use the offline credentials guide to separate location clues from secrets.

Plan who to contact after losing a device

Before a loss, note the verified contacts and official instructions you would need. This is not a universal first-hour deadline or an order that delays help:

  1. Check immediate personal safety and confirm whether the device is merely misplaced.
  2. Use the operating system’s official lost-device feature from a known device if it was enabled in advance.
  3. Lock or mark the device lost when appropriate; understand that remote actions may wait for connectivity.
  4. Contact the carrier through a verified channel if the phone or SIM may be misused.
  5. Contact affected financial institutions and managed-device administrators promptly. Use the provider’s official recovery process for affected accounts; do not delay reporting to complete this list.
  6. Follow the provider’s instructions for revoking a device or session after understanding the effect on legitimate access, tracking, and recovery.
  7. After legitimate access is regained, follow the provider for securing the account and replacing affected methods or codes; do not treat this as a rehearsal.
  8. Review alerts, forwarding, recovery details, purchases, and sessions.
  9. Notify employer or school IT immediately for a managed device or account.
  10. Record actions, times, and provider case numbers.

Erasing a device remotely may protect data but can affect tracking, evidence, or recovery. Follow the current platform, employer, insurer, and law-enforcement instructions for the actual situation. Do not confront a suspected thief.

Account recovery is also a phishing moment

An attacker can exploit the urgency of a lost phone. Treat unsolicited “device found,” “account locked,” “fraud department,” and “support” messages as untrusted until independently verified.

  • Navigate through a known app or manually entered official address.
  • Do not read a one-time or backup code to a caller.
  • Do not approve a push notification you did not initiate.
  • Do not install remote-control software for an incoming support contact.
  • Do not move money to a “safe account.”
  • Do not search for support and assume the first advertisement is legitimate.
  • Do not provide a recovery key to prove ownership; the key may be the access itself.

FTC guidance emphasizes reviewing recovery details, signing out unknown devices, changing compromised passwords, and enabling 2FA after retaking a hacked account.

Include disability, caregiving, and estate continuity

A recovery plan should work for the people who will use it. Consider visual, hearing, dexterity, memory, language, and cognitive access needs; reliance on a caregiver; and whether a device contains assistive-technology settings or communication tools. Do not interrupt prescribed care, disable an assistive device, or remove necessary communication to rehearse recovery.

If you are handling this alone, the provider’s route and a private note can still help. An authorized helper is optional, not a reason to share passwords. Use provider-supported family, legacy, delegate, or emergency-access features when available. Practical caregiving knowledge does not automatically grant legal access; the relevant provider, organizational policy, and qualified legal advice control the actual question. Keep permitted roles aligned with the family communication plan.

Review after every dependency change

Update the map when the household changes:

  • phone number or carrier;
  • primary email;
  • password manager;
  • trusted device or security key;
  • recovery contact;
  • employer, school, bank, insurer, or health portal;
  • family or caregiving role;
  • device platform;
  • provider recovery policy.

An optional reminder after a relevant change can help; no quarterly review or group meeting is required. Review one uncertain dependency privately. Do not destroy or replace necessary recovery material merely to tidy the map. Follow the actual provider’s replacement and retention process so a change does not remove your only usable path.

One account is enough to start

Choose one account and record where its legitimate recovery process starts. If you find a missing or uncertain fallback, check the official instructions before changing anything. You can stop there and return to the next account later. Use the MFA phone-loss guide for factor-specific questions and the digital continuity hub for the broader plan.

Sources reviewed

  • CISA: Use a Password Manager to Create and Remember Strong Passwords
  • NIST: How Do I Create a Good Password?
  • Federal Trade Commission: How to Recover a Hacked Email or Social Media Account; Use Two-Factor Authentication; How to Protect Your Phone From Hackers

Historical source review: July 14, 2026. NIST’s password article and the three named FTC pages were checked October 3 for password-manager, MFA, lost-phone, and post-recovery principles, not each provider’s current features. Follow the current official instructions for the exact account and device, and use organizational recovery for managed systems.