🔐 Account Recovery Lockout Map

“To get into my email I need a code sent to… my email.” Map what unlocks what, then simulate losing your phone, a house fire or a forgotten password. Finds circular recovery loops and single points of failure before they lock you out for good. Use labels only — never type real passwords or codes.

Anything on the right that isn’t itself an account (a password you remember, a physical phone, an ID document, printed backup codes) is a root factor — the things you can actually lose.

This models only what you type in; real providers may offer slower identity checks (ID upload, waiting periods) that aren’t listed. Nothing is saved or sent. Good fixes: printed backup codes kept away from home, a second security key, a trusted recovery contact, and not recovering an email account through itself.