Recovery Email / Phone 'Confirm' Hijack
Scammers trick you into 'confirming' or adding a recovery email/phone that is actually theirs, so they can take over your account and lock you out.
Think a message like this reached you? You can check it right now.
What this scam is
By phishing or social engineering, a scammer gets you to approve adding or 'confirming' a recovery email or phone number to your account — or to share a code that authorizes the change. Once their contact is on your account, they can trigger a password reset to their own email/phone and take over, locking you out. It's a quieter takeover that targets your account's recovery settings rather than your current password.
What it usually looks like
- A prompt to add or confirm a recovery email/phone you don't recognize.
- A request to approve a security-settings change.
- A code to share that authorizes a recovery change.
- Follow-on lockout or reset notifications.
Common warning signs
- Requests to add/confirm a recovery contact that isn't yours.
- Approving security changes you didn't start.
- Sharing a code tied to 'recovery settings.'
- Unexpected recovery-info-changed emails.
Example wording scammers use
“Confirm the new recovery phone number added to your account: reply YES with the code.”
“A recovery email was added. If this was you, approve; if not, verify here [phishing link].”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Their email/phone on your account as recovery.
- To trigger a reset and take over.
- To lock you out.
What to do
- Never approve or add a recovery contact you don't recognize.
- Review your account's recovery email/phone directly in security settings.
- Don't share codes about 'recovery' changes.
- Enable strong two-factor.
What to do if you already responded
- Remove the unknown recovery contact and change your password immediately.
- Revoke sessions and re-secure recovery settings.
- Report at reportfraud.ftc.gov.