Your main accounts are probably in decent shape. Long password, two-factor authentication, login alerts. You have done the work.

Now ask what happens when you click “Forgot password.” A reset link goes to a recovery email. If that recovery email has its own recovery email, the chain continues. Somewhere down that chain is an account you opened in 2009, have not logged into since, and protected with a password you have reused on a dozen breached websites.

That account is the real lock on your front door. Everything above it inherits its weakness.

How the chain works

Every account has a recovery path. Usually it is an email address, a phone number, or both. The platform trusts that path completely: whoever controls it can reset the password and, on many services, remove the existing two-factor method in the process.

Recovery paths form a chain. Your Instagram recovers to your Gmail. Your Gmail recovers to a Hotmail address and a phone number. The Hotmail address recovers to a Yahoo address you set up in college. The Yahoo address recovers to a phone number from two carriers ago. The chain is only as strong as its weakest link, and the weakest link is almost always the oldest.

Why old accounts are the target

Old email accounts have three problems. They predate modern security defaults, so two-factor authentication is usually off. Their passwords were set when “password strength” meant adding a number, and those passwords have since appeared in breach dumps that are freely searchable. And nobody is watching them. A login from a new country on your main Gmail triggers an alert you will see. The same login on a Yahoo account you forgot exists triggers an alert that lands in that same Yahoo account.

Attackers know this. The practical method is simple: find your old addresses in breach data, try the leaked passwords, and if one works, follow the recovery chain upward until they reach something worth having.

Old phone numbers are worse

Phone numbers get recycled. When you change carriers or drop a line, that number goes back into the pool and is reassigned to a stranger within months. If any of your accounts still list it as a recovery number, that stranger can receive your password reset codes. They may never try. The person who buys the number specifically because it was yours will.

Even a number you still hold is a weaker link than it looks. A SIM swap at the carrier moves your number to an attacker’s device, and every SMS reset code goes with it. The FBI’s Internet Crime Complaint Center logged 982 SIM swap complaints in its 2024 report, with roughly $26 million in reported losses. Those are the people who filed.

How the pivot actually looks

A typical sequence, compressed:

  1. The attacker finds a creator’s business email address, which is public by design.
  2. They run it through breach databases and find the old personal addresses linked to the same name or the same leaked passwords.
  3. One of those old addresses still accepts a leaked password. They log in.
  4. That old address is the recovery email for the creator’s current Gmail. They trigger a reset.
  5. Gmail now belongs to them. YouTube, Instagram, the password manager’s recovery, and the bank all recover to Gmail.

At no point did anyone attack a well-defended account. They attacked the one nobody remembered.

How to audit your chain

Set aside an hour. Open a document. Work through this in order.

  1. List every account that matters: email providers, social platforms, the password manager, Apple or Google account, banking, domain registrar, cloud storage, carrier account.
  2. For each one, open its security settings and write down the recovery email and recovery phone number it currently holds.
  3. For every recovery email you wrote down, repeat step two. Keep going until you hit the bottom of each chain.
  4. Flag every phone number you no longer control or that belongs to a carrier account without a PIN and a port freeze.
  5. Flag every email account you have not logged into in the last year, that lacks two-factor authentication, or whose password you also used anywhere else.

Most people find at least one recovery path to an account they cannot even log into anymore. That is the finding.

How to fix it

Collapse the chain. Your important accounts should recover to one or two email addresses that you actively use, protect with hardware keys or an authenticator app, and monitor. Remove every other recovery email and every old phone number.

For the bottom of the chain, consider a dedicated recovery address that is used for nothing else, is never published, and is secured with a hardware key. Its only job is to exist and be protected.

Delete the old accounts you do not need. If a provider lets you close an account, do it. If you want to keep an old address for sentimental or archival reasons, give it a unique password, turn on two-factor authentication, and remove it from every recovery role.

Replace SMS recovery with authenticator apps or hardware keys wherever the platform allows. Where a phone number is mandatory, make sure it is a number you control, on a carrier account with a PIN and a port-out lock.

Then put a reminder on the calendar to re-run the audit once a year. Platforms change their options, you change numbers, and the chain quietly drifts.

Where ShutOut comes in

Mapping a recovery chain is the first thing ShutOut does in an account hardening engagement, because it is where most takeovers actually begin. We trace every path, close the forgotten ones, move recovery onto protected infrastructure, and then watch the breach landscape for your old addresses and numbers so a new leak becomes a notification rather than a pivot point.