Check where your sign-in codes go

Think about the day you forget the password for your email. You ask the company to let you back into your email account, and the company sends you a code to prove that the person asking is really you. The code goes to the recovery phone number or the recovery email address on file. A recovery phone number is a phone number you gave the company so that the company can send you a code when you cannot sign in. A recovery email address is a second email address you gave the company so that the company can send you a code when you cannot sign in. The company also sends a warning to the recovery phone number or the recovery email address when the company sees a sign-in that may not be you.

Now think about the phone number you had two phones ago. If that old number is still the recovery phone number on file, the code goes to the stranger who has that number now. A scammer who has that old number gets the code and can get into your account.

So check the recovery phone number and the recovery email address on file and replace any you have given up with a phone number or an email address you hold today. On the workshop worksheet, this check is the first question in the yearly list: are the recovery phone numbers and recovery email addresses still mine?

Before you start

• About ten minutes for each account.
• Your phone or your computer, and the password for your Google Account, your Apple Account, or both.
• A second phone number that rings a phone you or a trusted person holds, if you have one: a spouse's phone or a landline.

Check each account

Google and Apple keep these numbers in different places and call them by different names. Do only the part under the heading for the account you have. If you have both a Google Account and an Apple Account, do both parts.

Google Account

Your Google Account is the account you use to sign in to Gmail. Google calls the recovery phone number Recovery phone and the recovery email address Recovery email. The steps are for a browser on a computer; a browser is the app you open websites in. If you are on a phone instead, the same names appear when you open myaccount.google.com in the phone's browser, and you tap where a step says click.

1. Open your Google Account. In the browser, go to myaccount.google.com. Find Security & sign-in and click it. Google sometimes labels this section Security instead of Security & sign-in.
2. Check the recovery phone number. Find the heading How you sign in to Google. Under that heading, find Recovery phone and click it. You may need to sign in again. Read the phone number shown. If that number does not ring a phone you hold today, find Edit and click it. Then enter a phone number you hold today. If you want to remove the number instead, find Delete and click it.
3. Check the recovery email address. Open your Google Account again the same way as in step 1. Find the heading How you sign in to Google. Under that heading, find Recovery email and click it. Read the email address shown. If that address is an old work address, an address at an email company you no longer use, or an address nobody can open, find Edit and click it. Then enter an email address you can still sign in to.
4. Check that it worked. Open your Google Account again the same way as in step 1. Find Recovery phone and click it. Read the number. Find Recovery email and click it. Read the address. The number should now ring a phone you hold today, and the address should be one you can sign in to.

Apple Account

Your Apple Account is the account your iPhone, iPad or Mac is signed in to. A trusted phone number is a phone number Apple can send a sign-in code to. A trusted device is an iPhone, iPad or Mac of yours that Apple can send a sign-in code to. Trusted phone numbers and trusted devices are both listed in a setting called Two-Factor Authentication. Two-factor authentication is Apple's name for two-step sign-in: Apple asks for your password and then for a second proof that it is really you. On a Mac, click where a step says tap.

1. Open the list of trusted phone numbers. Open the Settings app. On a Mac, the Settings app is called System Settings. Find your name and tap it. Find Sign-In & Security and tap it. On older software, this menu was called Password & Security instead. Find Two-Factor Authentication and tap it. Your trusted devices and trusted phone numbers appear in a list.
2. Add a second trusted phone number. Apple suggests a trusted phone number that is not tied to your iPhone, such as the second number from Before you start. If the iPhone is the only trusted device and the only phone with a trusted phone number, no code can reach you when the iPhone is lost or broken. Below the list, find Add Trusted Phone Number and tap it. Apple's page, as we read it, says nothing about the screen after that, so we cannot say what shows next.
3. Check that it worked. Open the list again the same way as in step 1. Read each phone number on the list. The list should show only numbers that ring a phone you or a trusted person holds today. If the list shows a number you have given up, remove the number on Apple's website. Apple's page, as we read it, gives no way to remove a number on the device. Go to account.apple.com. Find Sign-In and Security and click it. Find Account Security and click it. Find the section called Trusted Phone Number. Remove the number you have given up in that section. You cannot remove a trusted phone number when it is the only one on the list.

What this does not do

• A recovery phone number that is yours does not by itself turn on two-step sign-in, where the company asks for your password and then for a code. Two-step sign-in is a separate setting.
• This page does not stop a scammer from getting your phone number moved to a new SIM card. A scammer who gets your phone number moved to a new SIM card receives your codes; a SIM card is the small card inside your phone that carries your phone number. A PIN on your account with your phone company makes your phone number harder for a scammer to move.
• This page covers only your Google Account and your Apple Account. Your bank, your email if it is not Gmail, and your social accounts each have their own recovery settings. Each account takes about ten minutes to check.

If your screen looks different

On an Android phone, the account settings are under Settings, then Google, then Manage your Google Account. Android is the phone software made by Google; most phones that are not iPhones run Android. On Apple's website, you can also add a phone number in the Trusted Phone Number section from the last Apple Account step. If you cannot find the Two-Factor Authentication menu, search Settings for the words Two-Factor.

Sources

• Google: Set up recovery options (Computer), read on 18 October 2026.
• Apple: About trusted phone numbers and trusted devices for Apple Account, read on 18 October 2026.