My Parents Are Aging
Menu

When a Parent Is Locked Out of Their Email: The Account Recovery Playbook

A forgotten password usually means a five-minute reset. It becomes a two-week ordeal when the parent forgot the password, changed their phone number, and never set up recovery options, all at the same time. This page is the recovery order, the honest limits of what a family member can do, and the one-time setup that makes this problem mostly disappear.

Last reviewed August 2026 Reading time: 6 minutes

recovery depends on proof, not on being family

The account recovery map

The parent (or the family, with permission) has to prove ownership through recovery options set up in advance. If none exist, the process is slow and uncertain, and no amount of calling changes that.

  1. Which locked-out?Three different problems, three fixesForgot the password with working recovery options: the easy one. Recovery options stale (an old landline, a forgotten recovery email): the hard one, manual review. Or not locked out at all, just asked for a routine code: walk through slowly before assuming the account is broken.
  2. The recovery orderOfficial flow, parent present, every optionUse the provider's official "forgot password" flow on the real website typed yourself, with the parent present on their own device; try every recovery option in order (recovery email, phone, saved device); and check the spam folder and old devices before assuming a code failed.
  3. The manual reviewDays, not minutes, and honest answersUse the provider's manual account-recovery form (Google, Apple, Microsoft all have one) and answer the owner-only questions completely: the process is automated review, not a chat, so "I'm her son" is not an answer they accept. Do not submit repeatedly; duplicates slow it down.
  4. The honest limitsNo options, no proof, maybe no accountIf the parent has no recovery options and cannot answer the proof questions, the account may not be recoverable: providers do this on purpose, because an account anyone could claim by saying "that's my mom" would belong to everyone.

The rule, in one sentence: recovery depends on proof, not on being family. The parent (or you, with their permission) has to prove ownership of the account through recovery options that were set up in advance. If none exist, the process is slow and uncertain, and no amount of calling changes that.

First: figure out which kind of locked-out this is

There are three different problems that all look like "I can't get in," and they have very different fixes:

  • Forgot the password but the recovery email, recovery phone, or saved device still works: this is the easy one. A few minutes, usually.
  • Forgot the password and the recovery options are stale (the recovery phone is an old landline, the recovery email is an account that also got forgotten): this is the hard one. Recovery now depends on the provider's manual review, which is slow and can fail.
  • Believes they are locked out but are actually being asked for something routine (a verification code that was sent to their own phone, a security question): often nothing is wrong with the account at all. Walk through the steps slowly before assuming the account is broken.

The recovery order that works

  1. Use the provider's official "forgot password" flow on the real website, with the parent present, on their own device. This is not a task to delegate to a stranger or a search-result link: type the provider's address yourself or use a bookmark.
  2. Try every recovery option the parent has, in order: the recovery email, the recovery phone, the saved device (a phone or computer that has logged into the account before is often the strongest proof of all).
  3. If a code was sent somewhere, check that place before assuming failure. Codes can land in the spam folder, on an old tablet that still gets mail, or on a phone with notifications silenced.
  4. If the standard flow fails, use the provider's manual account-recovery form. Google, Apple, and Microsoft all have one (links in Sources). The form asks questions only the real owner could answer: when the account was created, old passwords, where the account was used. Answer honestly and completely; the process is automated review, not a chat, so "I'm her son" is not an answer they accept.
  5. Expect the manual review to take days, not minutes, and to be contacted at the recovery email or phone you provide during the process. Do not submit the form repeatedly: duplicates slow it down or cancel it.

The honest limits (read this before you promise anything)

The uncomfortable truth: if a parent has no recovery options and cannot answer the proof questions, the account may not be recoverable. Providers do this on purpose, because an account that anyone could claim by saying "that's my mom" would belong to everyone. The limits to be honest about:

  • Family relationship is not proof. You cannot recover the account by being the child, showing ID, or calling support. Proof is technical, and it was defined when the account was set up.
  • A parent with dementia or significant confusion may not be able to complete recovery even with the right options, because the questions require recall. Do this early, while they still can, not after a crisis.
  • If the account is truly unrecoverable, the work becomes damage control: change the password on every other account that used that email, tell the important contacts, and watch for impersonation using the dead email address.

What to do with a recovered account, today

Recovering the account is the moment to set up everything that prevents round two:

  1. Set a new password and store it in the family vault. See Set Up a Family Password Vault Together.
  2. Update the recovery email and recovery phone to ones that actually work, and add the parent's own email as the recovery address for their bank and other important accounts. This is the highest-leverage five minutes in the whole process.
  3. Turn on two-factor authentication. A recovery phone that receives codes is far more valuable than a password. See Two-Factor Authentication for Parents.
  4. Print the backup codes the provider offers, and put them in the vault with the password.
  5. Write down what was recovered and when in the shared document folder, so the next person who helps does not start from zero.

If the "locked out" is actually something worse

Sometimes "I can't get into my email" is not a forgotten password. It is an account that was taken over: the password was changed by someone else, the recovery options were replaced, and the real owner is locked out by design. Signs: the password stopped working suddenly, the recovery phone on file is not the parent's, or the parent received "account changed" emails they did not act on. That is not a recovery problem; it is a compromise. Start at Your parent's account was hacked: the 60-minute response instead.

Related

Sources

Found an error? Report it.

The next thing your family needs

Digital spring cleaning: simplifying a parent's online life

Also relevant: