How Do I Make Sure My Business Can Recover Its Accounts?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Recovery methods are the backup ways to get into an account when the password or second step fails: a recovery email, a recovery phone, and backup codes. Make sure every one of them belongs to the business, not to a former helper or a personal account, and keep backup codes printed or stored somewhere safe. Check them whenever someone leaves or a number changes.

What this means

11.7.4 Recovery methods

Most accounts let you set:

Recovery email: where reset links go
Recovery phone: where codes are texted
Backup codes: one-time codes you save ahead of time. Google gives a set of 10, and each code works once. You can make a new set any time, which turns off the old set.

Whoever controls these controls the account. A web designer’s email as the recovery address means the designer can take the account back, even after you change the password.

13.1.5 Domain recovery

Your domain registrar account needs the same care. Keep the recovery email, phone, and backup codes for the registrar under business control (see 13.1.2 Registrar Ownership). Don’t use an email address at the same domain as the only recovery email. If the domain stops working, that inbox stops too, and you can’t get the reset link.

Made-up example: Lakeside Family Chiropractic’s GBP owner account used the old office manager’s cell number for recovery. She left, the owner lost his phone, and the account was stuck for weeks. Now the recovery phone is the business mobile line and the backup codes sit in a sealed envelope in the office safe.

Why it matters

Lockouts happen at the worst time. A lost phone, a new number, or a forgotten password.
Old recovery details let ex-helpers back in.
Scammers change recovery details first when they take over an account (see 11.9.2 Account Takeover).
Domain lockouts are the hardest to fix. They can take your website and email down together.

Who this applies to

Every business with online accounts. The most important are email, the domain registrar, the website host, the Google account for GBP, the password manager, banking, and payroll.

How to do it

List every key account in your access inventory (see 11.7.5 Access Inventory).
Set a recovery email the business controls. Use a separate business address that doesn’t depend on the same domain, so a domain problem can’t lock you out of both.
Set a recovery phone the business controls, like a business mobile line (see 12.3.1 Main Business Phone Number).
Generate backup codes for each account that offers them. Google suggests printing them and keeping them somewhere secure, or downloading them.
Store codes in two places: your password manager and a printed copy in a locked spot away from the office computer.
Remove any recovery details that belong to former staff, contractors, or vendors.
Record the recovery setup for each account in your access inventory, without writing the codes there.
Recheck every time someone leaves, a phone number changes, or every few months.

What proof to keep

Access inventory showing the recovery email and phone type for each account
Screenshots of recovery settings, partly blurred
Dates backup codes were last created
The location of printed codes

Common mistakes

A former employee’s phone as the recovery number.
A personal Gmail as the recovery email for the business Google account.
Domain recovery email at the same domain.
Backup codes saved only on the one computer that just got ransomware.
Never testing. Confirm the recovery email gets messages.
Letting the web designer set it all up under their own email.

When to get help from a pro

Information technology (IT) specialist: if you’re already locked out, or have many accounts to clean up. Questions to ask:

Which of our accounts still point to people who left?
How do we recover the domain if the registrar email is gone?
Where should we keep printed backup codes?

Bill’s note

[Bill: add a short note. For example, a client who couldn’t get into their Google Business Profile because the recovery phone belonged to a former staff member, and how long it took to fix.]

If you’d rather have this done for you, SiteSmarty handles Google Business Profile setup and can check that your business controls the recovery details.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: the recovery email, phone, and backup codes I set for each SiteSmarty account]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: recovery settings for the Google account and domain registrar]
[Result so far:]

Questions people ask

What are backup codes? One-time codes you can use to sign in if your phone or key isn’t available. Google gives 10 at a time, and each works once.

Where do I keep backup codes? In your password manager and as a printed copy in a locked place. Don’t share them. Google says it never asks for a backup code except when you sign in.

What if the recovery phone belongs to someone who left? Change it right away to a business number while you still have access.

How do I protect my domain recovery information? Use a business-controlled recovery email that isn’t on the same domain, turn on multi-factor authentication, and save the registrar’s backup codes.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
11.7.4 Recovery methods	Do recovery emails, phones, and backup codes for key accounts all belong to the business?	Business-controlled recovery details, backup codes stored in two safe places, checked after staff changes	Personal or former staff details, no backup codes	Access inventory recovery column, settings screenshots
13.1.5 Domain recovery	Is domain registrar recovery under business control and independent of the domain itself?	Business recovery email on a separate address, business phone, saved backup codes	Recovery email at the same domain, or a vendor’s email	Registrar recovery settings screenshot

Where this fits

Do this first: 11.7.3 Multi-Factor Authentication, 12.1.2 Email Accounts and Shared Inboxes

Do this next: 11.7.5 Access Inventory

Sources

Google Account Help, "Sign in with backup codes" (checked October 17, 2026)
Google Account Help, "Secure a hacked or compromised Google Account" (checked October 17, 2026)
Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.