The phone is unavailable. Pretend carefully.
Your email asks for a phone prompt. Your password manager wants a code from the same phone. Your backup codes are in a screenshot. On the phone. Excellent security. It has also secured the account from you.
This is a preparation drill for accounts you own, using a second trusted computer you control. Keep your normal session open and your phone available for stopping the exercise. Do not erase the device, delete passkeys, remove authentication methods, or sign out everywhere to make the exercise realistic.
Draw the chain before touching settings
Start with three services: your main email, password manager, and Apple or Google device account. For each, identify what unlocks it and where that requirement lives. Use service labels rather than full account details in your notes.
Follow each dependency one step further. If recovering the password manager requires email, can you open email without the password manager? If the alternate address forwards to the same inaccessible mailbox, you have drawn a circle with better branding.
Use the printable recovery rehearsal sheet. It asks for methods, locations, and outcomes. Keep passwords, recovery codes, and device PINs off the worksheet; record only a private location reference.
Prepare one independent route
Open the service’s security settings directly. Check that recovery addresses and numbers still belong to you. Choose an alternative supported by that particular service: an already enrolled spare security key, an available passkey on another device, or saved backup codes. A synced passkey is useful only if you can unlock its credential manager without the missing phone. Do not assume syncing proves recoverability.
For Google accounts using ordinary 2-Step Verification, backup codes are available under Security & sign-in → 2-Step Verification → Backup codes. Each code works once; generating a replacement set invalidates the old set. Keep a protected copy accessible without the phone, and never send it to someone claiming to be support. Google’s backup-code instructions explain availability and exceptions.
For passkeys, check which device or credential manager holds each one. Google documents passkeys on other devices and security keys; a phone-based QR sign-in still requires that phone. Read its passkey guidance before changing anything. Managed work accounts may require help from an administrator.
Run one real sign-in, then stop
- On your second trusted computer, open a separate browser profile or private window. Keep the existing working session open elsewhere.
- Type the service’s known address yourself. Avoid login links from messages or search advertisements.
- Attempt sign-in using the independent method you prepared. If offered a phone prompt, choose the service’s alternative-method option.
- If the only route needs the missing phone, stop and mark the test incomplete. Use your existing session to improve the plan. Do not repeatedly guess or deliberately trigger formal account recovery.
- If you reach the account, confirm you are in the correct one. Sign out of the test session and close the window. Mark any backup code you consumed as used; retain the unused codes securely.
Repeat separately for the other two services. Success with email does not establish that your password manager is recoverable. Private mode avoids reusing some session state; it does not make a borrowed computer trustworthy.
Know what the rehearsal cannot promise
Providers can require additional checks during an unfamiliar or suspicious sign-in. Record exactly which route worked, on which trusted device, and when; do not turn one successful attempt into a guarantee. Revisit the plan after replacing a phone or changing authentication.
If a phone is actually lost or stolen, switch from rehearsal to the provider’s incident instructions. Google describes alternate sign-in and lost-device steps. Apple’s password-reset and recovery guidance follows a different process. Contact your carrier through a known channel if the SIM or number is also at risk.
Once access is stable, continue with the account security manual. The objective is strong authentication with an exit you have actually located.