account-recovery-plan

# Account Recovery Plan

Losing access — to email, socials, or a bank login — is high-stress, and that's exactly when people fall for fake "account recovery" scammers. This maps the *official* recovery route for your account, tells you what proof to gather so you pass verification, and — critically — how to re-secure everything once you're back in, since a hacked email often means other accounts are exposed too.

## What This Skill Produces

- **The official recovery route** — the real recovery flow for that provider/account type (not a third party)
- **Proof to prepare** — the identity/ownership evidence their process asks for (recovery contacts, past passwords, device, ID)
- **A recovery-order plan** — do email first (it's the reset hub for everything else), then dependent accounts
- **The re-secure checklist** — change passwords, reset 2FA, revoke unknown sessions/devices, check forwarding/rules
- **Scam warnings** — the fake-support and paid-recovery traps that prey on locked-out users

## Required Inputs

Ask for these if not provided:
- **Which account** — email, social, bank, gaming, etc., and the provider
- **What happened** — forgot password, lost 2FA device, hacked/taken over, or account disabled
- **What you still have** — recovery email/phone, backup codes, a trusted device, old passwords
- **Signs of compromise** — changed recovery info, unknown logins, missing 2FA
- **Linked accounts** — what else uses this email to log in or reset

## Framework: Official Route, Prove It, Re-Secure

1. **Start with the hub.** If email is compromised, recover it first — it resets everything else. Sequence recovery accordingly.
2. **Use only the official flow.** Go to the provider's real help/recovery site directly; never a "recovery agent," paid unlocker, or DM offering help.
3. **Prepare the proof.** Gather the exact evidence their process accepts (recovery contact, backup codes, device, prior passwords, ID) before starting to maximize success.
4. **Re-secure immediately after access.** New unique password, reset 2FA, sign out all sessions, and check for attacker-planted forwarding rules, recovery-info changes, and connected apps.
5. **Sweep the blast radius.** Update any account that used the compromised email and watch for follow-on fraud.

## Output Format

### Recover: [account/provider] · [locked out / hacked / lost 2FA]

**Order:** [email first if affected] → [dependent accounts].
**Official route:** [the provider's real recovery flow — go directly].
**Prepare:** [recovery contact / backup codes / trusted device / prior password / ID].

**Once back in — re-secure**
- New unique password · reset 2FA (save backup codes) · sign out all sessions/devices · check forwarding rules & recovery info · review connected apps.

**Blast radius:** update accounts that reset via this email; watch for fraud.

> No legitimate provider recovers your account via a DM, a paid "unlocker," or a number from a random search ad. Use the official site only.

## Quality Checks
- [ ] Recovers email/hub account first when it's compromised
- [ ] Directs to the official provider recovery flow only
- [ ] Lists the specific proof to prepare for verification
- [ ] Includes a full re-secure checklist (password, 2FA, sessions, forwarding rules)
- [ ] Covers the blast radius of linked accounts
- [ ] Warns against fake-support/paid-recovery scams

## Anti-Patterns
- **Recovering a dependent account** before the compromised email.
- **Trusting a "recovery service"** or DM offering to help.
- **Getting back in but not re-securing** — attacker walks right back.
- **Missing planted forwarding rules / recovery-info changes.**
- **Ignoring linked accounts** that reset via the same email.

## Example Trigger Phrases
- "I'm locked out of my email and lost my 2FA — how do I get back in?"
- "My Instagram got hacked, help me recover it."
- "Someone changed my account's password and recovery email."
- "I forgot my password and don't have my authenticator anymore."
- "Got back into my account — how do I make sure they can't return?"