There is a moment that arrives for most Gmail users eventually: the password will not work, the phone with the code is lost or stolen, or a message says someone signed in from an unfamiliar place. What happens next depends on a setting that takes two minutes and that most people in Bangladesh have never opened. A recovery email is a second address to which Google sends a code so you can prove the account is yours and set a new password. Without it — or a recovery phone — Google has no safe way to know you from the person trying to break in, and accounts stay locked.
On a computer
- Open Gmail and click your profile picture at the top right.
- Click Manage your Google Account.
- Choose Security in the left-hand menu.
- Scroll to Recovery email and click it. Google will ask for your password.
- Type the alternative address in the box and click Next. A verification code is sent to that address.
- Enter the code. The address is now your recovery email.
On the Gmail app
- Tap your profile picture or initial at the top right.
- Tap Manage your Google Account, then Security.
- Scroll to Recovery email, tap it, and confirm with your fingerprint, face or password.
- Enter the alternative address, tap Next, and type the code that arrives there.
Which address to use
Use an account you control and check occasionally — a second Gmail, an Outlook or Yahoo address, or a family member’s address if you have no second one of your own. Do not use a work address you may lose when you change jobs, and do not use the same account as a recovery address for itself, which Google will refuse anyway. If the recovery address itself has a weak password, it becomes the back door: an attacker who gets in there can reset your main account.
Finish the safety net
While you are on the Security page, three more items make the account genuinely recoverable. Add a recovery phone — codes by SMS reach you even without data. Turn on 2-Step Verification, which stops most account theft outright. And download the backup codes: ten one-time passwords that work when you have neither the phone nor the recovery email, printed and kept somewhere other than your wallet. For a country where the Gmail account is also the login for bKash, Facebook, the university portal and the passport application, this is not optional housekeeping. It is the difference between an inconvenient afternoon and losing everything at once.
The two ways a recovery address fails
Setting one is easy; setting a useful one takes a moment’s thought, and both common mistakes produce an address that looks fine until the day you need it.
The address you will lose. A work or university address stops being yours when you leave, and nobody updates their recovery settings on their last day. If your recovery address ends in your employer’s domain, you have handed account recovery to the HR department.
The address behind the same lock. A second Gmail that you only open on the same phone, protected by the same screen lock, is not a second point of recovery — it is the same one wearing a different name. Lose that phone and you lose both.
The address that works is one you control, on a different provider, that you can open from somebody else’s computer with a password you actually remember.
Then do the part most people skip
Under Security → 2-Step Verification there is an option for backup codes: ten single-use numbers you can print. They are the only recovery method that works with no phone, no network and no second mailbox. Print them, put them where you keep your passport, and the worst version of this problem can no longer happen to you.
