Build a recovery set that survives one loss
The primary method and every backup should not disappear together when one device, bag, number, or account is lost.
Primary authenticator
Select the strongest practical method the provider supports, with phishing resistance where available.
Independent backup
Register another authenticator or protected recovery method stored apart from the primary device.
Recovery check
Review official recovery contacts, notifications, active sessions, and where single-use codes are protected.
Prioritize by dependency. Primary email, the mobile number, password manager, device account, and work identity can authorize resets across many other services. For each one, review the provider's strongest supported method and the devices or people currently trusted. A passkey or physical security key can resist phishing better than a code, while an authenticator app and even text-message MFA can still improve a password-only account when stronger options are unavailable.
Recovery must survive the failure it is meant to solve. A screenshot of recovery codes on the protected phone, a spare key on the same key ring, or a backup email that depends on the locked account is not independent. Store a protected backup elsewhere, register more than one authenticator when allowed, and keep provider notifications current. Never test by intentionally removing the only working method. Instead, review the official sequence and confirm you can locate the backup without exposing its secret.
- Secure the account that can reset other accounts first.
- Keep at least one recovery route separate from the primary device.
- Reject unsolicited login prompts and never disclose a one-time code.
The backup that was not independent
A person saves recovery codes in a photo on the same phone used for the authenticator app. When the phone is lost, neither method is reliably available. A better setup places a protected copy in a separate physical or encrypted location and registers a second authenticator where the provider permits it.
Why the backup must survive the same loss
- MFA reduces account-takeover risk but cannot make a fraudulent approval, malicious recovery change, or compromised session safe.
- Never read a login code to an unexpected caller or approve a prompt you did not initiate.
- Providers differ. Follow the current account interface and recovery rules instead of instructions sent by an unsolicited support contact.
Evidence basis: The cited sources support the checks above. They do not replace current provider, property, workplace, authority, or local requirements. CISA: Multifactor Authentication and NIST: Authentication and Account Recovery.
MFA and account recovery setup checklist
Secure the accounts that reset other accounts first, then work outward. Test normal sign-in without deliberately locking yourself out.
Provider methods and recovery rules differ
Use the security controls in the provider's known app or website. Never share a one-time code, approve an unexpected prompt, or follow recovery instructions from an unsolicited caller. Keep live secrets out of worksheets and exposed notes.