Clear Path step · Home · Logins that are hard to steal
Close the back doors: fix account recovery
Your key accounts can only be recovered through phone numbers, emails and codes you control.
Why it matters: As passkeys make sign-in harder to steal, attackers move to the recovery process: old phone numbers, old emails and talked-into-it support agents. A strong lock with a weak back door is a weak lock.
Do it
- On each key account, remove old recovery phone numbers and email addresses you no longer control.
- Generate fresh recovery codes, print them, and store them with your important papers.
- Set a recovery contact where offered, such as Account Recovery Contact on an Apple account.
- Review signed-in devices and connected sessions, and sign out of anything you don't recognize.
- Write down what you'd do if your phone were stolen tomorrow: which device or code gets you back in.
Say this: If I get a recovery code I didn't ask for, I never share it and I check the account myself.
Check it worked: Every key account has current recovery details only, recovery codes stored offline, and a trusted recovery contact where the platform offers one.
Simply put
A strong front lock doesn't help if the back door is open. Old phone numbers and emails are back doors: removing them and keeping fresh codes on paper means the way back in runs through you.
In detail
Infostealer malware now takes browser session cookies that skip sign-in entirely, so 'sign out of all other sessions' after any suspected compromise is part of recovery, not an afterthought. Recovery planning and legacy planning are the same work done for different reasons.
Points toward the Long View: a recovery plan that doubles as your family's way in later.