# Your email and phone number can unlock your other accounts. Protect them first. Staying a step ahead · 05 · 10 min read Email and a phone number often sit inside the recovery settings for other services. The useful work is to find which accounts still depend on each one, then protect those paths in an order that fits what happened. This page helps you: - Find which accounts depend on your email and phone number - Prepare before a lost phone or a number change - Know what to do if your phone suddenly loses service The order matters because accounts can reset one another. Email may receive a reset link for your bank or social account. Your phone number may receive a sign-in code. Start with the accounts that receive those messages, then work outward through every service that names them as a recovery method. ## Follow one moved number through your accounts. Accounts reset one another, so one link can open several. In this fictional set, someone has moved your phone number to their own SIM. Choose one change to see which accounts the number can still reach. Illustrative accounts · real services differ ### No changes With the number moved, a texted code opens the inbox, and the inbox can reset the bank, social media, and shopping accounts. The bank and social accounts also accept a text directly. Still reachable: email inbox, bank, social media, shopping Out of reach through these links: password manager · work account ### Inbox recovers with a passkey, not a text The inbox no longer opens with a text, so the shopping account, which resets only by email, is out of reach. The bank and social accounts still accept a texted code, so the number reaches them directly. Still reachable: bank, social media Out of reach through these links: email inbox · shopping · password manager · work account ### Remove the number from bank and social The bank and social accounts stop accepting texts, but the number still opens the inbox, and the inbox can reset both. Cutting the direct links changes little while the inbox is reachable. Still reachable: email inbox, bank, social media, shopping Out of reach through these links: password manager · work account ### Both changes With the inbox on a passkey and the number removed from the bank and social accounts, the moved number reaches none of these accounts. It still receives your calls and texts until the carrier restores it. Still reachable: none Out of reach through these links: email inbox · bank · social media · shopping · password manager · work account ### Not linked to the number or inbox - **Password manager**: In this example it recovers only with its master password and a recovery code you keep. A manager built into an email or phone account follows that account instead. - **Work account**: In this example, recovery goes through the employer's IT team rather than your personal number or inbox. A passkey protects how the inbox recovers from now on. It does not undo access someone already has. Forwarding rules or connected apps can keep copying mail after a password change, so review those too. ## A phone number can move without the phone In a SIM swap, someone causes a phone carrier to move your number to a different SIM or carrier account. If the carrier completes the change, future calls and texts, including sign-in codes, arrive on the other device. Your original phone can stay in your hand while its cellular service disappears. The code itself has not been broken. Its delivery route changed. Carrier controls have different names and coverage, so ask what prevents a SIM change, what prevents a number port to another carrier, and how you will be notified about either request. ## A carrier PIN or port-out lock Call your mobile carrier, or open its app, and ask which of these controls are available. The names, coverage, and availability vary by company and country. 1. A port-out lock or number lock, which can add another check before your number is moved to another phone or carrier. Ask the carrier exactly what its control covers. 2. A separate account PIN or passcode, which a carrier may require before supported account changes. Choose one that isn't your birthday or address. 3. Lock the online carrier account itself, with a strong, unique password and its own second step. A SIM swap can begin with access to the carrier website, so this adds another barrier. 4. Save that PIN in your [password manager](https://explained.withpersona.com/your-identity-online/password-managers), since you'll rarely use it but will be glad to have it. A PIN on your mobile account, and an authenticator app or security key in place of texted codes, also appear in guidance from the [FTC](https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself) for protecting against SIM swaps. ## Settings to review before the phone is gone These settings can close off several common paths. Revisit them after changing phones, carriers, recovery details, or the people who can access the device. - **A screen lock and auto-updates.** Use a screen lock and leave operating-system and app updates on. Check the device maker's recovery instructions too. - **A look at app permissions.** Every so often, check which apps can see your location, contacts, and microphone, and switch off what doesn't need them. - **Knowing the "find my device" path.** Set up the device maker's find, lock, and erase options before you need them, and know how to reach your carrier from another device. - **A recovery path that does not depend on this phone.** Follow each service's documented recovery options. Store recovery codes or other backup details where you can reach them if the phone is lost, stolen, or replaced. ## When a phone is lost or stolen, start with what it can still reach Use another device you trust, and start with the device maker's current instructions. The controls available depend on the device, its settings, and whether it can connect. Reviewed July 2026. Official starting points: [Apple's lost or stolen iPhone and iPad steps](https://support.apple.com/120837) · [Google's Find Hub steps for Android](https://support.google.com/android/answer/6160491). **What changes the urgency** What state was the phone in? - Locked with a passcode only you know: Mark it lost and protect the number promptly. - Unlocked, or the passcode may be known: Treat key accounts and payment access as urgent. - A managed device or work account: Contact the organization's IT or security team. - Still with you, but the number lost service: Use the SIM-swap steps below. 1. Locate, mark the phone as lost, or lock it through the maker's official service. If it was stolen, do not try to retrieve it yourself when that could put you in danger. If it is managed by work or school, contact that organization's IT or security team too. 2. Contact the mobile carrier if the phone was stolen, remains missing, or you need the SIM or service suspended. Ask it to protect the number and explain any device-blocking option it offers. A phone that is merely misplaced, locked, and still reachable may not need this step yet. 3. If the phone may have been unlocked, someone may know its passcode, or sensitive apps were open, use a trusted device to protect email, your password manager, financial accounts, and mobile-wallet cards. Follow each provider's sign-out and recovery instructions. 4. Save the time, location, device serial number or IMEI if available, and any carrier or police report number. Those details can help with insurance, account recovery, or a theft report. 5. Treat remote erase as a later, irreversible choice. What remains traceable afterward differs between Apple and Android, so use the current maker instructions above after protecting key accounts and deciding the phone is unlikely to return. ## Review every way back into your email Changing the password does not remove every other form of access. Recovery settings can admit someone again, while forwarding rules and connected apps can keep sending out copies of new mail. Review those paths alongside the main sign-in. Open your email's security and settings pages and check these four. Review them again after changing a phone number, recovery address, or trusted device. - **Your recovery email and phone.** Make sure they are still yours, and still current. An old address you no longer control is a way back in for someone else. - **Forwarding rules and filters.** A rule can copy mail elsewhere or hide particular messages from the inbox. Delete any forwarding address, filter, or rule you did not create. - **Connected apps and devices.** Review what has access to the account, and remove anything you do not recognize or no longer use. Changing the password may not revoke every connection. - **Where you're still signed in.** Many email services offer a "sign out of all other sessions" control. It can end sessions that remain open, but it does not replace checking forwarding, connected apps, and recovery methods. **Every way back into your email** Your inbox - The password: The main sign-in - Recovery email and phone: Still yours, and current? - Forwarding rules and filters: Copying or hiding mail? - Connected apps and devices: Still recognized? - Signed-in sessions: Still yours? Changing the password closes one way in. Review the others alongside it. > Your inbox is where reset links arrive. Protect every way back into it, and you protect far more > than your email. ## If your phone suddenly loses service A phone that suddenly shows no service, when nearby phones still have signal, can be an ordinary outage. It can also be a sign that your number was moved to another device. Contact the carrier promptly to find out which happened. 1. Call your carrier from another phone, or use its app over wifi, and ask whether your number was moved or ported. This separates a carrier change from an ordinary service outage. 2. If the carrier confirms a change, ask it to restore the number and protect the account against another move. Keep any reference number it gives you. 3. From a device you trust, review email and financial accounts that use the number for sign-in or recovery. For a work or school account, contact its IT or security team. Follow a provider's recovery process when you find a change or cannot sign in. 4. If the carrier confirms an ordinary outage and your accounts show no unfamiliar changes, takeover recovery may not be necessary. If the number moved or an account changed, work through [recovering an account](https://explained.withpersona.com/your-identity-online/account-taken-over). ## Start with the accounts underneath the others 1. Ask your carrier whether it offers a port-out lock, number lock, or account PIN, and what each control covers. 2. Where a service supports it, consider an app or passkey instead of texted codes. Keep a backup method that follows the service's recovery guidance. See [two-factor & passkeys](https://explained.withpersona.com/your-identity-online/two-factor). 3. Give email extra attention because it often resets other accounts. Check its password, second step, recovery methods, forwarding rules, and active sessions. 4. If your number suddenly loses all signal for no reason, treat it as a possible SIM swap and contact your carrier from another phone. Then see [recovering an account](https://explained.withpersona.com/your-identity-online/account-taken-over). --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/phone-and-accounts_