A
recovery email is an address a service may use to confirm your identity, send security notices or help reset access. It is different from a one-use backup code, but both are ways back into an account. Someone who controls your recovery inbox may be able to intercept important messages.
A useful example
You secure a shopping account with a unique password, but its recovery address is an old mailbox with a reused password. If that mailbox is taken over, the attacker may start a reset or hide its notices. The strength of the shopping password is only part of the story.
A five-minute review
Open your important accounts directly and confirm their recovery address belongs to you, is active and has a unique password plus MFA. Remove addresses you no longer control. Keep separate backup codes where offered. Google's
recovery-information guidance explains why current contact details matter; our
recovery-code article covers the separate emergency method.
Practical distinction
A recovery address must be usable when the main account is unavailable. Check it periodically and avoid making two accounts depend on each other as their only recovery route.
