Account lockouts are rarely caused by forgetting a password. They are caused by the recovery route having quietly stopped working months earlier. This is a fifteen-minute review worth doing once a year.
The circular dependency
The most common trap: the recovery address for your account is a mailbox on the very domain that account controls. If the domain expires or the hosting is suspended, the mailbox stops working — and the notices telling you about it were sent to that mailbox.
Fix this by making sure at least one contact on your account uses an address on a completely different domain and provider. This one change prevents a whole family of problems.
What to check
- Every email address on the account. Does each one still belong to someone who works here? Can each one actually be read today?
- Phone numbers. Including for two-factor. A number tied to a former employee's mobile is worse than no number.
- Contacts and their notification settings. Does someone receive billing notices? Does someone receive technical ones? Is it the same overloaded person for both?
- Backup codes. Do you still have them, and can you find them within a minute?
- The domain registrant address. Separate from your portal contact details, and the one that receives transfer approvals and expiry notices.
Use role addresses
Where your mail system allows it, prefer billing@, it@ or accounts@ over an individual's mailbox. Role addresses survive resignations, holidays and reorganisations. A named individual's address is a dependency on that individual.
When someone leaves
Add this to your offboarding checklist:
- Remove them as a contact on this account, and on your domain registrar, mail platform and any other vendor portal.
- Replace them as the recovery address anywhere they were listed.
- Rotate any shared credential they had — and take the opportunity to stop sharing it.
- Check whether any two-factor method is registered to their device or number.
Step four is the one that gets missed and the one that causes a lockout eighteen months later.
Write down what you actually own
Keep a short list of the vendors that matter, what each one holds, and which address recovers it. Store it in your password manager alongside the credentials. During an incident, not knowing where a service is registered costs more time than anything else.
Set a reminder
Once a year, on a date you will not move. Ten minutes then is worth days of account recovery later.
If you want us to confirm which addresses are currently on your account, open a ticket and ask — we will tell you what is on file so you can check it against reality.
