Get Back Into Google via Recovery Contacts

Being locked out of your Google account no longer has to mean days of dead ends. Google is also introducing Recovery Contacts, a friend-assisted protocol that lets you prove it’s really you trying to get back in and fast-track your way past those pages of forms or the mysterious security questions.

The feature relies on a simple concept: When you are stuck, someone with whom you have a connection can vouch for you via a one-time code. It’s coming at a time when account lockouts are still as prevalent and expensive—security reports from companies like Verizon’s Data Breach Investigations Report continue to list stolen or lost credentials as the top ways into accounts that end up in compromise. Meanwhile, Google and the FIDO Alliance have championed passkeys as being both faster and less error-prone than passwords, but recovery still matters when a device is lost or login goes sideways.

How Google’s Recovery Contacts verification works

You provide a list of trusted friends or family members—up to 10—that are willing to be recovery contacts. They have no access to your email, files, or settings. They serve the single purpose of verifying who you are when locked out.

When you are not able to sign in, a unique verification code must be generated by Google’s account recovery flow. You then provide that code to one of your recovery contacts, ideally over the phone or in person. After your contact confirms the code on their end, Google allows you to continue recovery and be reunited with your account. This isn’t a permanent permission that is opened up; it’s a one-time assist tied to a code you give.

Set up Recovery Contacts in minutes on web or mobile

Log in to your Google account on the web or a mobile device. Open Security and tap How you sign in to Google; select Recovery contacts. Choose Add a recovery contact, select the name or email address of the person you trust from your contacts, then press Send. Before they can do anything for you, they’ll need to accept.

• Log in to your Google account on the web or mobile.
• Open Security > How you sign in to Google > Recovery contacts.
• Choose Add a recovery contact, select the person, and press Send.
• Your contact must accept before they can assist with recovery.

Select contacts who are accessible at a moment’s notice, and who don’t mind verifying security codes. Consider enlisting several people from different spheres of your life—family, a close friend, perhaps even a colleague or neighbor—so that someone is at hand when you need them. Revisit your list from time to time, as people change numbers or drop out of your inner circle.

Use Recovery Contacts when you are locked out of Google

In the event of a failed sign-in, choose account recovery if you’re prompted. You will be able to see the verification code for the session. Have one of your recovery contacts read the code to you over the phone, and repeat it; they confirm on their end. After you’ve been verified, follow the guided steps to get back into your account—such as resetting a password or confirming a passkey.

• Don’t send the code as screenshots or in a group chat.
• Use speed dial to minimize the risk of phishing or inadvertent forwarding.
• Treat the code like a one-time password—short-lived and secret.

Eligibility and limits for adding Google recovery contacts

Up to 10 recovery contacts can be added. Child accounts effectively can’t add recovery contacts, nor can they serve as one. Accounts that are part of enterprise programs like Google Workspace and those already in Advanced Protection can’t add recovery contacts, but they can still be a contact for someone else.

Your contact will know it’s you and approve the verification request, but they won’t be able to see your emails, files, or personal data. They cannot reset your password or access your account beyond verifying the code that you supply.

Security and privacy considerations for recovery contacts

Account recovery is a common attack vector, and is also highlighted by the National Institute of Standards and Technology in its digital identity guidance. Recovery contacts assist by requiring an out-of-band human verification with a code only you can request. It’s not like there is a shared password, and the contact never has ongoing access.

For the best security, you’ll want to combine this feature with passkeys and two-step verification, keep backup codes in a safe spot offline, and get rid of recovery options that aren’t used. The Google Security Blog has repeatedly pointed out that account takeover risk is substantially reduced by tiered defenses, specifically noting such phishing-resistant approaches as passkeys.

Related sign-in updates rolling out across Android and Messages

Google is also rolling out Sign in with Mobile Number for Android setup. When switching to a different device following loss or failure, your phone number can be used to identify your account; entering the previous device’s lock screen passcode finalizes the sign-in. It’s built to make recovery easier without sacrificing the protections connected with the old device.

In messaging, Google Messages will now default to warning you if a text is spam, and blocking malicious links until you indicate that the message is safe. A built-in Key Verifier makes it even easier to verify the keys of contacts you trust, available on devices running Android 10.0 or later. These guardrails seek to mitigate social engineering, such as spoofed messages, that are commonly used for account takeovers.

Bottom line: enable recovery contacts and strengthen sign-in

Recovery contacts make a stressful lockout into an easy phone call. Build them out now, pick people who are accessible to you, and refresh the list. With passkeys combined with two-step verification and a bit of good hygiene, this little boost can be the difference between minutes of inconvenience and days cut off from your digital life.