What your role actually involves
Being listed as someone’s Apple Recovery Contact does not give you access to their account, their password or their devices. It makes you one part of a recovery process the owner still runs themselves. Your contribution is verification and a code — not a login.
The owner does the account work: they verify account information and start recovery, then contact you directly. You do not need to sign in anywhere on their behalf, and you should not be asked for their password at any point.
The locked-out owner first verifies account information and starts recovery, then contacts the designated helper directly. Source
A checklist for the helper
Use this before you generate anything:
- Confirm it is really them. Use a channel you already had for this person, not one supplied by whoever is asking. A message that introduces itself with a new number or account is a reason to pause, not to act.
- Confirm the request is about their own account. You are helping the person you agreed to help, not a third party acting for them.
- Never accept or request a password. You do not need it, and holding it would make you a security risk rather than a helper.
- Generate the code only after the owner has started recovery and has asked you for it.
- Hand the code over directly to that person and no one else.
- Do not enter the code for them. They enter it on their own device.
Generating the code
When the owner has started recovery and contacted you, the helper’s path on their own device is:
- Open Sign-In & Security.
- Open Recovery Contacts.
- Open Account Recovery For.
- Select the person who asked.
- Choose Get Recovery Code.
A helper can open Sign-In & Security, Recovery Contacts, Account Recovery For, select the person and Get Recovery Code. Source
Then pass the code to the owner through the channel you used to verify them. They complete the rest on their side.
Who gets the code
This is the part most worth slowing down for. A code is only as safe as the person who receives it, and a request can arrive from someone who is not the account owner.
Apple says to give a recovery code only directly to that friend or family member, not another person requesting it on their behalf. Source
In practice: if someone contacts you saying the owner asked them to collect the code, that is exactly the situation Apple warns about. Decline, and go back to the owner through your known channel.
Decision table: should you act?
| Situation | What to do |
|---|---|
| The owner contacts you through a channel you already use with them and asks for a code | Verify, then generate and give the code directly to them |
| Someone you do not know asks for the code on the owner’s behalf | Do not provide it; contact the owner through your known channel |
| The request arrives from a new number or account claiming to be the owner | Pause and verify through a channel you already had |
| The requester asks for the owner’s password or offers theirs | Do not share or accept passwords; your role does not require them |
| The owner asks you to log in as them | Decline; they enter the code on their own device |
| You are unsure whether the request is genuine | Wait. Recovery can resume once you have confirmed the person |
Limits worth knowing
- You are not the recovery decision-maker. The owner starts recovery and completes it; you supply verification and a code.
- A code is not a password and does not make you the account holder. Do not treat it as permission to sign in as them.
- Nothing here guarantees a particular outcome or timing. The steps above describe the helper’s part, not a promise that recovery will succeed on a schedule.
- You cannot confirm identity from a profile. A matching photo, name or handle on a social account is not proof that the person messaging you is the owner.
- A username scan is not account recovery. A tool like TraceSeek can review public handles across 3,000+ platforms, but it does not recover accounts, reveal connected logins or change platform settings. Its first scan is free and needs no registration or login.
A useful verification step
Before you generate a code, ask the owner one thing only they would know and that you can check independently — for example, something from a conversation or arrangement you already share. Do not use details the requester supplied in the same message, since those prove nothing.
If that check fails or you cannot complete it, stop. Tell the owner through your known channel that a request came in and that you have not acted on it.
Where this fits with other checks
Recovery is about one account. If your wider question is which accounts are tied to an email address in the first place, that is a different task: see email account inventory. Public matches found there are leads to review, not proof of ownership, and they do not substitute for the verification steps above.