People do not lose their accounts because recovery is impossible. They lose them by doing the steps in the wrong order — resetting the bank while somebody else is still reading the email the reset link lands in.

The order, worked out from what you still hold

Nothing is saved and nothing leaves the page. Mark the things you genuinely still have — not the ones you think you could get — and the accounts you need back. If money is moving right now, ring the bank's fraud number while you read.

Why the order is the whole thing

• One account is the master key. Your main email is where the reset links for everything else arrive. So do not start with the bank, the shopping account or the social account: that sends a fresh set of keys to whoever is holding the inbox.
• The phone number is the softest second factor there is. A number can be moved to a new SIM by somebody with a plausible story and a few of your details, and text-message codes then arrive at their phone. That is why the first call is to the network and not to the bank.
• Changing a password does not remove anybody. Existing sessions can survive it, and so can a forwarding rule, a filter that deletes the alerts, an added recovery address, an app password, a connected app, and a second authenticator the attacker enrolled. The eviction is a separate job from the password.
• The reset you cannot undo is the one done from the compromised device. If a phone or laptop might have something on it, every password typed into it is the next password they get. Use a different device, or a device you have just reinstalled.
• Deleting the hacked account destroys the way back in. It also destroys the evidence, the message history somebody may need, and any chance the provider can help. Suspend, lock, revoke — do not delete.
• The slow route exists and it is worth starting early. Every large provider has an identity-based recovery process for people with nothing left. It takes days, it is worth beginning on day one rather than day four, and it needs a second address, ID, and the details of the account's own history.

Evicting somebody, which is not the same as changing the password

• Sign out everywhere. Every provider has a list of active sessions and devices, and a button that ends all of them. Do this after the password change, not before, or the new password walks straight into the old session.
• Read the forwarding, the filters and the rules. A single forwarding rule keeps a copy of every message flowing after you have locked everything else. Filters that delete security alerts are the second thing to look for.
• Check the recovery addresses and phone numbers on the account. An added one is a permanent way back in, and it is the single most commonly missed item on this list.
• Revoke app passwords and connected apps. Anything that logs in without a second factor — old mail clients, third-party apps, calendar and file integrations — keeps working after every password change until it is revoked.
• Look at the second factors themselves. An extra authenticator, an extra passkey, a printed set of codes that is not yours: enrolled second factors are the quiet way an attacker keeps an account they have been evicted from.
• Then change the password, on a clean device, to something not used anywhere else. And check the account's own security or login history afterwards, because it tells you whether you actually finished.

When nothing you hold opens anything: the identity route

• Start the provider's own recovery form on day one. It is slow, it is often the only route, and the clock starts when you file it rather than when you give up on the other ways.
• Have the account's history ready. Roughly when it was created, the last password you remember, recovery addresses you set, the devices you used, a payment made through it, an old label or folder name. Providers weigh these, and vague answers are what fail.
• Use a second address you control for the reply. If you do not have one, make one first, on a clean device, with a second factor that is not a text message.
• The phone shop is the fastest counter of all. ID in person usually puts your number on a new SIM the same day, and that alone re-opens every reset that runs by text.
• Banks and work accounts do not need the email at all. A card and ID at a counter, or the fraud line; and an IT desk that can lock and reissue in minutes. Both of these are worth doing in parallel rather than after.
• Tell the people who will be targeted next. The account being used is being used against your contacts, and a one-line message to them is faster than any recovery process.

What genuinely cannot be recovered, and what to salvage instead

• A password manager's master password. The whole point of the design is that the provider cannot read your vault, which means they cannot restore it either. The emergency kit, the recovery code you printed at setup, or a second person with emergency access are the only routes; without them the vault is gone and the work is resetting every account it held, in this page's order.
• A cryptocurrency seed phrase. There is no recovery, no support desk and no reversal, and anybody offering to recover one is running the second scam on top of the first.
• An account whose email address no longer exists. If the address was with a provider you have left, or a domain that lapsed, the reset has nowhere to go and the provider's identity route is the only way.
• Money already sent by bank transfer. Sometimes recallable in the first hours, often not; the fraud line and the reporting reference matter for the reimbursement question, which is separate from the recovery question.
• Messages, photos and files deleted by whoever got in. Some providers keep a recycle bin for weeks. That is worth checking early, because the window closes quietly.
• The time this takes. Every hour spent guessing passwords is an hour not spent on the two things that always work: the phone shop with your ID, and the provider's own form.

The twenty minutes that make all of this unnecessary

• Print the recovery codes for your main email and keep them where you keep your passport. This is the single highest-value thing on the page. Codes bypass every second factor, they cost nothing, and they work when your phone is at the bottom of a canal.
• Move off text-message codes for the email and the bank. An authenticator app or a passkey cannot be taken by moving your number. Keep a text-message fallback only where nothing else is offered.
• Put a PIN or a port freeze on the phone account. One phone call, and it is the difference between a SIM swap being a phone call and being impossible.
• Set a second email address you control as the recovery address — and check it still exists. A recovery address pointing at an account you abandoned is worse than none, because it looks like a route and is not.
• Write down which accounts sit behind which email. Not the passwords: the list. It is what turns a two-week recovery into an afternoon, and it is the thing nobody has when they need it.
• Tell one other person where the codes are. The emergency-access feature in a password manager, or an envelope. Somebody being unreachable is the other way this becomes unrecoverable.

What people believe, and what is so

The drill: 16 lockouts

Sixteen ordinary evenings — the stolen phone with the authenticator on it, the reset email that never arrived because a filter was deleting them, the friend whose account is messaging everybody, the vault whose master password is gone. Each has an obvious first move that costs you the account. Pick the order; every answer explains why.

The card

Print it, fill in the top two lines now, and put it with your passport. It is worth more before anything happens than after.

🖨️ Print the card