Locked Out of Email and the Recovery Number Is Dead

Password recovery assumes you still hold the thing you registered with. When the recovery number belongs to a SIM you threw away two moves ago, the polite reset flow turns into a wall — and every account that used that mailbox as its own recovery address is now sitting behind it.

[[answer]]Stop feeding the automated reset and switch to the provider's account-recovery form — the long one that asks what you remember — and fill it in from a device and location you have used with that account before. Recovery is decided by the weight of matching signals, not by any single correct answer.[[/answer]]

Why the reset button stops helping

Automated recovery has exactly one job: prove you are the same person, cheaply. It does that by sending a code somewhere you already control. Remove that channel and the flow has nothing left to test, so it does the safe thing and refuses. That refusal is not a bug you can argue with — it is the product working.

Worth saying plainly, because the opposite is widely repeated: failed attempts do not burn your chances. Google states outright that wrong guesses will not remove you from the recovery process and that there is no limit on attempts. What repetition does cost is time and, on some providers, a temporary throttle on how often a code can be sent. So the third identical attempt is not dangerous — it is simply unlikely to differ from the first two.

The form you actually want

Behind the automated flow every large provider keeps a manual review path: Google's account recovery form, Microsoft's recovery questionnaire, Apple's account recovery with its waiting period. They look discouraging because they ask for things you half-remember. That vagueness is deliberate — the review weighs many weak signals rather than demanding one strong one.

[[steps]] Use a device that account has used before :: A browser that has signed in successfully, on the home network. This single factor carries more weight than most people expect. Answer from memory, not from a guess sheet :: Approximate is fine — "spring 2019" beats a confident wrong date. Deliberately padded answers read as fabrication. List old passwords, oldest first :: A password from three years ago is strong evidence. Only the real owner remembers the discarded ones. Name contacts you email often :: For mail accounts this is one of the heaviest signals, and it is one an attacker cannot fake. Give a working contact address :: A mailbox you actually check daily. The result may take days to arrive. Submit once and wait :: Parallel submissions do not speed anything up, and a second form filled in from a strange device makes the picture noisier rather than stronger. [[/steps]]

What to do while you wait

The dead mailbox is rarely the whole problem. It is usually the recovery address for several other accounts, so it is also the key to them. Spend the waiting period mapping that: banking, the phone's own account, work tools, anything with money attached. Where you still have access, move the recovery address off the dead mailbox now — before the review comes back, whichever way it goes.

Also check whether the number itself has been recycled. Carriers reissue disconnected numbers after a holding period, typically months rather than years, and the new holder can receive codes meant for you. If your old number is live in someone else's pocket, the recovery channel is not merely broken, it is hostile. US regulators keep a dedicated database of reassigned numbers precisely because the problem is common, and the practical takeaway is short: treat a number you no longer pay for as belonging to a stranger.

Recovering the number instead

Sometimes the faster route is the carrier, not the platform. If the number lapsed recently and has not been reassigned, many operators will reactivate it on the original account holder's ID. That turns an unanswerable recovery into an ordinary one — the code arrives, the reset works, and the whole problem dissolves in an afternoon. It is worth one phone call before you commit to a two-week review.

The part people regret skipping

Once you are back in, the instinct is to change the password and close the tab. The change that actually matters is different: add two recovery channels that fail independently. A second mailbox on a different provider, plus an authenticator app whose codes are generated on the device rather than sent to it. Codes that arrive by SMS depend on a number, and a number is exactly what turned out to be borrowed.

Print the backup codes. Every provider offers them, almost nobody saves them, and they are the one recovery method that works when the phone is gone, the number is gone and the second mailbox is also behind the first.

[[faq]] How long does manual recovery take? :: Usually three to seven days, up to two weeks when the account is old or the signals are thin. A refusal can be appealed once with better answers, not with the same ones resubmitted. Does a VPN hurt my chances? :: Yes, noticeably. Location consistency is part of the assessment. Turn it off for the submission and use the network you normally use. Can support restore access over chat? :: For consumer accounts, no. Front-line support cannot override account security, and any service claiming otherwise for a fee is selling a story. What if the account had no other channel at all? :: Then old passwords, creation date and frequent contacts carry everything. Answer those three as precisely as you can and accept that the odds are real but not certain. Is it safer to just start a new account? :: Sometimes. If the mailbox holds no financial recovery and no irreplaceable history, a clean account set up properly beats weeks of appeals. [[/faq]]

The uncomfortable lesson is that recovery is not a right you exercise; it is a case you make. The evidence has to exist before you need it, which is why the ten minutes spent adding a second channel today is worth more than any amount of persistence later.