Locked out by the security system that was protecting you

Everything below about account lockout loops comes from what actually happens rather than from what is supposed to.

Recovery is where authentication systems are weakest

Logging in successfully is tested constantly, because it happens millions of times a day and any failure is immediately visible. Recovering from a lost factor happens rarely, involves human judgement and fraud risk, and is therefore both undertested and deliberately slow.

The result is a system with an excellent front door and a recovery process that occasionally has no door at all. It is also the part attackers target, since compromising recovery bypasses every other control in one step. That tension is genuine, and it explains why recovery is frustrating rather than why it has to be as bad as it often is.

The circular lockout

A common failure is needing an emailed code to access an account, while the email account itself requires a code sent to the first one. Another is a phone lost with the authenticator app on it, where the recovery route requires a code from the authenticator app. These loops are structurally simple and appear repeatedly because each system is designed in isolation and assumes the other is available.

Somewhere in the release notes, they are hardest to escape when both accounts belong to different organisations, since neither can verify you for the other. The defence is entirely preparatory, because once you are inside the loop the options are support queues and patience.

Why SMS is the weakest common factor

A code sent by text depends on control of a phone number, and numbers can be ported, reassigned or socially engineered away from you. Number transfer fraud is a documented attack, and it defeats SMS-based second factors completely without touching your password. Travelling with a different network, losing a physical card or changing provider can also break SMS delivery at the worst moment.

An authenticator app generating codes on the device is stronger, because it depends on possession of hardware rather than on a carrier record. A hardware security key is stronger again and is the option most resistant to phishing, since it verifies the site as well as the user.

Backup codes are the thing nobody saves

Most services offer single-use recovery codes at the point the second factor is enabled, and almost nobody stores them anywhere retrievable. They are the designed escape hatch, they cost nothing, and printing them once removes the majority of lockout scenarios permanently.

Somewhere in the release notes, storing them inside the account they unlock is a common and self-defeating choice, as is storing them only on the device that might be lost. A printed copy somewhere physically secure is unglamorous and is the recommendation of essentially every security guide for this reason.

Regenerating them after use takes a minute and is the step people forget, which quietly removes the safety net again.

Registering a second factor before you need one

Almost all services allow more than one second factor, and having two independent ones removes the single point of failure entirely. A second hardware key kept elsewhere, or an authenticator on a tablet as well as a phone, both achieve this cheaply. Keeping a recovery email address on a different provider avoids the circular case where one outage locks both accounts.

Recording which accounts use which factor, once, turns a future emergency into a checklist rather than an investigation. This is the whole of the advice, and its dullness is exactly why the lockout industry continues to thrive.

When you are already locked out

Use the official account recovery form rather than searching for support numbers, since impersonation of support is a common secondary attack. Provide the strongest evidence you have, which is usually an original purchase record, a device identifier or a long-standing billing relationship. Expect delays measured in days, because a fast recovery process is a security hole and organisations know it.

Do not create a duplicate account to complain from, as it frequently complicates identity verification rather than helping it. And when you get back in, set up the second factor and the backup codes immediately, while the memory is still fresh and painful.

The takeaway

Print the backup codes and register a second factor before anything goes wrong.

It is not you being fussy. It is genuinely badly made.