Getting back into a locked email account

If you are locked out of your inbox right now, go to your provider’s official recovery page by typing the address into the browser yourself, and start the process from the device and the home Wi-Fi you normally use. That last detail is not fussiness: these systems weigh where the request is coming from, and an attempt made on the household computer stands a considerably better chance than the same attempt made on a neighbour’s phone.

Then take it one step at a time. The account is not lost because the first try failed, and it will not unlock faster for twenty attempts in a row. The rest of this article covers the routes that actually exist, what to do when your backup options are stale, and how to recognise a fake recovery page.

Why email is the account that matters most

Your email address is not one account among many. It is the master key to your entire life online.

Look at any site where you have an account: the bank, the utility, the pharmacy, Amazon, the government. Every one of them has a “forgot password” button, and every one of them sends the reset link to the same address. Whoever controls that inbox therefore controls everything else, without needing to know a single other password.

That is why a locked email account feels like an emergency, and why it is the first account worth protecting properly.

First: are you actually locked out?

Three very different situations hide behind “I can’t get my email”, and they are not fixed the same way.

The password no longer works, on any device. That is a real lockout. Recovery is the route.

The password still works somewhere else. If mail still arrives on the phone but not on the computer, this is almost never an account problem. It is the mail app that has lost its settings. Changing the password here fixes nothing and complicates everything.

Someone else has taken the account. The signs: the password changed without you, your contacts are receiving odd messages, or the provider warned you about an unusual sign-in. Recovery is urgent in that case, because the intruder can change the backup options and close the door permanently.

One more thing worth ruling out before you start: a typing mistake. Caps Lock, a keyboard that switched language, or an autofill entry saved from a different account will all produce the same “wrong password” message as a genuine lockout. Type the password into a blank document first so you can see it, then copy it across.

The recovery routes that exist

The major providers all offer broadly the same doors. Here they are, fastest to slowest.

The backup phone number. A code arrives by text or by voice call. It is the most common route and the quickest, when the number is still current.

The backup email address. A second address, often created long ago and half forgotten. It receives the reset link.

A device that is still signed in. If you are still logged in on the phone or the tablet, the provider can put an approval prompt on it. This is frequently the easiest door, and the one nobody thinks of first.

Printed backup codes, if you turned on two-factor authentication and kept the list.

The recovery form. The last door, when none of the above works. The provider asks a series of questions to establish that the account is yours, then takes some time to decide.

Customer service, but only for certain addresses. An address supplied by your telecom company is recovered over the phone, using your customer number. The free addresses from the large providers have no support line at all, and that gap is precisely what fraudsters exploit by publishing fake “support” numbers.

The recovery form: how to give yourself the best odds

Once you reach this stage, the request is judged on a bundle of signals. What genuinely helps:

1. Submit from your usual device, on your usual Wi-Fi, in your usual browser. This carries the most weight by far.
2. Answer from memory rather than guessing repeatedly. An approximate answer beats no answer, but a flood of contradictory attempts works against you.
3. Give the approximate date the account was created, along with the addresses of your most frequent correspondents and recent message subjects, if you are asked for them.
4. Provide a contact address where the provider can write back, and watch it, junk folder included.
5. Wait. The delay is often measured in days. Restarting the process over and over sometimes resets the clock.

When your backup options are out of date

This is the most common case and the most frustrating: the backup number is an old mobile you cancelled in 2019, and the backup address is a mailbox you have not opened in a decade.

What to try, in order:

• Recover the old backup address first. If it still exists with its provider, unlocking it may be easier than forcing the main door.
• Check whether the old number can come back. A recently cancelled number can sometimes be reactivated by your mobile provider. If it has been reassigned to a stranger, that route is closed.
• Hunt for a device still signed in. An old tablet in a drawer, the computer at the cottage, a replaced phone that was never wiped. Do not switch them on in airplane mode: they need a connection to receive the approval prompt.
• Move on to the recovery form with every detail you can assemble.

Do not delete the old backup mailbox or cancel the old number while any of this is in progress, even if they look useless. They are evidence that the account is yours, and providers sometimes reach for them late in the process.

If all of that fails, what remains is a practical decision rather than a fight to keep waging: create a new address and move the accounts that matter across one by one, starting with banking and government services. It is tedious, but it ends. A recovery battle can drag on for weeks and never resolve.

Spotting a fake recovery page

Someone locked out and in a hurry is exactly the target fraudsters look for. Three simple rules.

Type the address yourself. Never arrive at a recovery page through a link in an email or a text, or through a sponsored result at the top of a search. Type the provider’s site into the address bar.

No legitimate service charges you to reopen an account. Not by gift card, not by transfer, not at all. A phone number presented as “support” for a free email service is almost always fake, in the same way as the usual tech-support scams.

Nobody needs control of your screen to help you recover an account, and nobody should ask you to read out a code you received by text. That code exists precisely to keep another person out.

Once you are back in: the next ten minutes

If the account may have been taken by someone, regaining access is not the end. An intruder usually leaves doors propped open.

1. Change the password to a unique one, never used anywhere else.
2. Sign out of every other session. Providers offer a “sign out everywhere” button.
3. Check forwarding rules and filters. This is the most common trace left behind: a quiet rule copying your mail elsewhere, or one sending anything containing the word “bank” straight to the trash.
4. Check the backup address and phone number, along with the signature and any auto-reply.
5. Review the list of connected devices and remove anything you do not recognise.
6. Turn on two-factor authentication if it was not on, and print the backup codes.

Ten minutes of prevention, today

Open your email account’s security settings while everything is fine, and do these four things.

1. Fix the backup phone number. Your current number, not the previous one.
2. Fix the backup email address. Ideally a spouse’s or an adult child’s, or a second address of yours that you open at least once a year.
3. Turn on the second factor and print the backup codes, filed with your important papers.
4. Put a note in the calendar to check these settings again a year from now.

A well-maintained email account is recovered in five minutes. A neglected one takes three weeks, or never comes back. The whole difference sits in those ten minutes.

If you are locked out right now and the process keeps going in circles, getting back into a mailbox is part of our email and online accounts service, and the cleanup after unauthorised access falls under security and privacy. It works well remotely, with no visit needed.