What a recovery email is and how to pick one
Your recovery email is the address a service writes to when you can't log in: to confirm it's you, warn you about something odd, or send a link to recover the account.
- What it is
- Contact email for account recovery
- Since
- Standard practice for years
- Verdict
- Yes, but…
What it is
Almost every important account (Google, Microsoft, social networks, banks) asks for a recovery email address when you create it. It serves three purposes: warning you if someone tries to get in without your permission, confirming your identity when you forget your password, and receiving a code or link to get back in.
Google, for example, explicitly recommends using an address you check regularly, but different from the one you use to sign in to that same account. It doesn't have to be a new or complicated account: an old email you can still open is enough, ideally from a different provider.
When it was introduced
There's no specific launch date: it's a security practice major email providers rolled out gradually as account-theft attempts grew, long before two-step verification existed as we know it today.
Why it's used
It's the most-used recovery route because almost everyone already has a secondary or old email. When it works well, it gets you back in without depending on your phone or an SMS.
The problem shows up when the recovery email is the same account you're trying to recover, or when you can only open it from the same phone you've lost. In both cases, you've created a loop: the spare key lives inside the same box that's now locked. It also happens if your recovery email is an account you haven't used in years and have forgotten the password to: on paper you have a way out, but in practice you can't use it.
Should you use it?
Yes, as long as it's a different account you can open without that phone. If it depends on the same circle, it isn't a way out — it's the same problem with another name.
Check this
- Is your recovery email a different account from the one that receives your 2FA code?
- Can you open that email without using the phone you're protecting?
- Do you know that recovery email's password by heart?
Official source: Google help: account recovery information