Account recovery: options and limits

Losing access to an account usually means losing the password, the second factor, or both. Plan for that before it happens. This guide covers the recovery options you control, what support staff can and cannot do, and how recovery codes fit in.

Options you control

• Login password. Keep it in a password manager. A forgotten login password is one of the most common causes of lockout, and the only preparation that helps is doing it in advance.
• Second factor. If you use TOTP, keep the authenticator on a device you can still reach, and back up its setup key if your app supports that. If you use FIDO2, register at least two keys and keep the spare somewhere safe. See the TOTP guide and the FIDO2 guide.
• Recovery codes. Generate them in Account > Security once two-factor authentication is on. Store them offline, for example in your password manager's secure notes or on paper in a secure place. Treat each code like a password, and assume a used code is spent. If you suspect the set has been exposed, generate a new set and replace the old one.

What support can do

Support can help with access problems once the person asking has shown that they control the account. Write to support@itpromail.com and describe what you see, when the problem started, and which factors you still have. Include nothing secret in the message.

What support cannot do

• Open your mailbox on your behalf without your login and second factor.
• Decrypt PGP-encrypted messages. Decryption depends on your PGP private key and its passphrase. If both are lost, those messages cannot be read by anyone.
• Tell you your existing login password.
• Remove two-factor authentication from an account without proof that you control it.

Steps when you are locked out

1. Use a recovery code if you have one.
2. Use a second FIDO2 key, or your other authenticator device.
3. Check whether a saved password in a mail client is causing repeated failures. Stop retrying, because repeated failed attempts can trigger a temporary block. See login troubleshooting.
4. If none of this works, contact support@itpromail.com.

Stay safe while you recover

Do not send your password, recovery codes or one-time codes by email, to support or to anyone else. Treat any message that asks for them as phishing. If you receive unexpected security notices or suspect someone else has access to your account, write to security@itpromail.com.

If you are closing your account, note that it becomes read-only for 30 days before permanent deletion. Export your mail during that window; see exporting your mailbox.