account-recovery-plan

Account Recovery Plan

Losing access — to email, socials, or a bank login — is high-stress, and that's exactly when people fall for fake "account recovery" scammers. This maps the official recovery route for your account, tells you what proof to gather so you pass verification, and — critically — how to re-secure everything once you're back in, since a hacked email often means other accounts are exposed too.

What This Skill Produces

• The official recovery route — the real recovery flow for that provider/account type (not a third party)
• Proof to prepare — the identity/ownership evidence their process asks for (recovery contacts, past passwords, device, ID)
• A recovery-order plan — do email first (it's the reset hub for everything else), then dependent accounts
• The re-secure checklist — change passwords, reset 2FA, revoke unknown sessions/devices, check forwarding/rules
• Scam warnings — the fake-support and paid-recovery traps that prey on locked-out users

Required Inputs

Ask for these if not provided:

• Which account — email, social, bank, gaming, etc., and the provider
• What happened — forgot password, lost 2FA device, hacked/taken over, or account disabled
• What you still have — recovery email/phone, backup codes, a trusted device, old passwords
• Signs of compromise — changed recovery info, unknown logins, missing 2FA
• Linked accounts — what else uses this email to log in or reset

Framework: Official Route, Prove It, Re-Secure

1. Start with the hub. If email is compromised, recover it first — it resets everything else. Sequence recovery accordingly.
2. Use only the official flow. Go to the provider's real help/recovery site directly; never a "recovery agent," paid unlocker, or DM offering help.
3. Prepare the proof. Gather the exact evidence their process accepts (recovery contact, backup codes, device, prior passwords, ID) before starting to maximize success.
4. Re-secure immediately after access. New unique password, reset 2FA, sign out all sessions, and check for attacker-planted forwarding rules, recovery-info changes, and connected apps.
5. Sweep the blast radius. Update any account that used the compromised email and watch for follow-on fraud.

Output Format

Recover: [account/provider] · [locked out / hacked / lost 2FA]

Order: [email first if affected] → [dependent accounts].

Official route: [the provider's real recovery flow — go directly].

Prepare: [recovery contact / backup codes / trusted device / prior password / ID].

Once back in — re-secure

• New unique password · reset 2FA (save backup codes) · sign out all sessions/devices · check forwarding rules & recovery info · review connected apps.

Blast radius: update accounts that reset via this email; watch for fraud.

> No legitimate provider recovers your account via a DM, a paid "unlocker," or a number from a random search ad. Use the official site only.

Quality Checks

• [ ] Recovers email/hub account first when it's compromised
• [ ] Directs to the official provider recovery flow only
• [ ] Lists the specific proof to prepare for verification
• [ ] Includes a full re-secure checklist (password, 2FA, sessions, forwarding rules)
• [ ] Covers the blast radius of linked accounts
• [ ] Warns against fake-support/paid-recovery scams

Anti-Patterns

• Recovering a dependent account before the compromised email.
• Trusting a "recovery service" or DM offering to help.
• Getting back in but not re-securing — attacker walks right back.
• Missing planted forwarding rules / recovery-info changes.
• Ignoring linked accounts that reset via the same email.

Example Trigger Phrases

• "I'm locked out of my email and lost my 2FA — how do I get back in?"
• "My Instagram got hacked, help me recover it."
• "Someone changed my account's password and recovery email."
• "I forgot my password and don't have my authenticator anymore."
• "Got back into my account — how do I make sure they can't return?"