Security Basics: Checking Who Can Recover an Account When the Owner Is Locked Out
Most security conversations focus on how people sign in. Fewer address how they get back in when something goes wrong: a departed employee's phone is lost, an admin leaves the company, or a login provider is temporarily unavailable. Account recovery is the quiet side of access control, and it often determines whether a small business can keep operating after an incident. This article walks through how to map recovery paths across the tools your team relies on, and what to ask vendors before you depend on them. The guidance here is general and educational. It describes methods and questions, not promises about any specific product.
Why recovery paths deserve their own review
When teams audit access, they usually list who can sign in. That list is incomplete. Every account also has recovery mechanisms: a backup email address, a phone number for one-time codes, a set of printed or stored recovery codes, or an administrator who can reset a password. Each mechanism is a second door into the same room. If the recovery door is weaker than the front door, an attacker does not need to defeat your sign-in process at all.
Recovery paths also fail in predictable ways. A backup email address may belong to a former employee whose mailbox still exists. A phone number may be tied to a personal device that the owner replaced without updating the account. An administrator may be the only person who knows how to reset a shared login, which becomes a single point of failure the day that person is unavailable. A recovery review surfaces these weaknesses before they cause a crisis.
Building a recovery inventory
Start with a simple spreadsheet. List each tool your business uses that holds customer data, financial information, source code, or administrative control. For each one, record the primary sign-in method, every recovery method the vendor offers, and who currently controls each recovery channel. Note whether recovery codes exist, where they are stored, and who has access to them.
Pay particular attention to accounts that were created by one person and never transferred. Domain registrations, cloud billing accounts, social media profiles, and app store developer accounts are common examples. These often rely on an email address or phone number that belongs to an individual rather than the business. Record the owner of each recovery channel as a role, such as the operations lead or the office manager, so that the information survives staff changes.
Questions to ask vendors before you trust them
When evaluating a tool, ask the vendor how account recovery works and read the answer against your own requirements. Useful questions include: What recovery methods are available, and can an administrator disable the weaker ones? Can more than one administrator be designated, so that no single person holds the only path back in? How are recovery codes generated, displayed, and invalidated after use? What happens to an account when the person who owns the recovery email or phone leaves the organization? Is there a documented process for regaining access when all administrators are unavailable?
Do not assume the answers. Ask for the vendor's documentation and confirm the behavior in a test account before relying on it. If a vendor cannot explain its recovery model clearly, treat that as information about how much effort your team will need to spend when something goes wrong.
A practical checklist for small teams
Work through the following checks once a quarter and whenever someone joins or leaves the team. First, confirm that every critical account has at least two named administrators, and that both can actually sign in. Second, verify that every recovery email address and phone number belongs to a role-based or company-controlled channel rather than a personal one. Third, check that recovery codes are stored in your team's password manager or another controlled location, with access limited to the people who need them. Fourth, remove recovery methods that point to former employees or retired devices. Fifth, record the date of each review and who performed it.
Finally, run a short drill. Pick one non-critical account and walk through the recovery process as if the primary administrator were unavailable. Note every step, every delay, and every point where you needed someone who was not present. The gaps you find in a calm test are far cheaper to fix than the ones you discover during an actual lockout.
Keeping the review alive
Recovery paths drift. Vendors change their sign-in flows, staff turn over, and phone numbers are reassigned. Treat the recovery inventory as a living document and attach it to your onboarding and offboarding procedures. When someone leaves, the checklist should include removing them from recovery channels, not only from active accounts. When a vendor announces a change to its authentication options, add a review item to the next cycle.
The goal is not perfect security. It is a team that can reliably regain access to its own systems without depending on any single person's memory, device, or inbox. A short, repeated review of recovery paths gets a small business most of the way there.