PURPOSE Recovery email accounts are often the key to resetting other accounts. BEST PRACTICES Use a strong unique password and multifactor authentication. KEEP RECOVERY INFORMATION CURRENT Review recovery phone numbers and alternate email addresses regularly. BE CAREFUL Do not ignore password reset notifications for accounts you did not try to reset. BEST PRACTICE If attackers control the recovery account, they may control everything connected to it.