An old phone number can become a security and recovery problem after it is reassigned. If that number remains attached to email, social, banking, or advertising accounts, verification messages may go to someone else. The safest time to prepare is before changing carriers or giving up the number.
Before you change or port the number
- List important accounts, starting with your primary email because it often controls recovery for everything else.
- Add a current recovery email and verify it.
- Replace the old number in profile, security, two-factor authentication, business-manager, and advertising settings.
- Move authentication to an authenticator app when the service supports it, and keep a second approved recovery method.
- Generate recovery codes and store them offline in a secure place.
- Review active sessions and sign out devices you no longer use.
- Add an account PIN or port-out protection with your mobile carrier.
Do not overlook business assets
Facebook Pages, Instagram profiles, ad accounts, Google Business Profiles, YouTube channels, and other business assets may have separate administrator and recovery settings. Give at least two trusted people appropriate administrative access, using their own named accounts. Do not share one personal login among employees or vendors.
If you already lost access to the old number
- Try the official recovery flow from a device and location you have used before.
- Use a saved recovery code, trusted device, recovery email, or authenticator app if offered.
- For Facebook, start with the official hacked-account or account-recovery flow—not a support number found in search results.
- Secure the primary email account and mobile-carrier account before repeatedly resetting social passwords.
- Preserve screenshots and notification emails if business pages, ads, or payments were changed.
Watch for fake recovery services
Scammers pose as platform support staff and promise to recover accounts for a fee. Do not send passwords, one-time codes, recovery codes, identity documents, or cryptocurrency to someone who contacted you through a message or comment. Use the platform’s official help center and in-app recovery tools.
Make recovery information part of routine maintenance
Review recovery email addresses, phone numbers, administrators, connected apps, and active sessions at least a few times per year and whenever an employee, agency, or phone number changes. A password manager can help keep unique credentials organized.
Official instructions are available from Google for recovery phone and email settings and Meta for compromised Facebook accounts.
Need help securing business accounts?
PCC can help a small business document account ownership, improve access controls, and reduce single-person recovery risks. Explore cybersecurity services.