Take it from me: When a site asks for a backup email address to use for security reasons, NEVER give them your work email!

I learned this the hard way when I tried logging in to an old Hotmail.com (Outlook.com) account and it suddenly started asking if I’d requested a security info change.  I hadn’t requested a change, but whether I said I did or not, Microsoft was too concerned about my security to let me log in to my 18 year old account anymore.  With an account this old, it’s nearly impossible to remember every company I’ve used this address with over the years, and so the idea of never having access to it again made me a little nervous about the cascading effect that could happen if I suddenly also lost access to these other places who used my Hotmail address to verify my identity in their security backup plans.  Once you’ve had an account for over a decade, you’re pretty much stuck with it for life.

Hotmail said it would be easy to resolve this security issue – they would just send me a text message at a mobile number I’d given them, or I could enter a code found in an email they’d sent to the alternative address they had on file for this Hotmail account.  The problem was, I’d never given them a phone number, and the only email address they had on file was one that I no longer had access to, which was from a job I’d worked at for nearly 15 years.  Like my ancient Hotmail account, this really old business email address had been used for a lot of things over the years too.  Luckily, 99% of it was no longer my concern – I just handed over my credentials to my replacement, and forgot all about it.  Until Hotmail locked me out and insisted on sending a code to my old company email account, which I now no longer had access to!

I contacted my former colleagues, hoping they could get someone to log in to the account and forward the message containing the code to me, but they’d already deleted my account in the process of moving to a new email platform.

(RainingForks Bonus Tip: If you’re an email administrator NEVER EVER delete email accounts from staff who have left the organization after more than a few months’ of work!  Simply disable the account and remove it from the public address book! That way when your boss, or someone else, comes to you a year later trying to settle an argument about who said what, or if you need to re-register for an event, etc., you’re not out of luck. And of course, if there’s ever litigation at your company they’ll demand all correspondence, so it’s good to have a record of it stored somewhere for legal reasons.  For most IT folks this is standard practice, but if you’re one of the few people who still deletes old accounts, stop now – you’re only causing yourself needless headaches – especially when storage space is so cheap now, there’s really no reason to delete anything that could possibly be useful someday.)

Microsoft offers no other options for verifying your identity.  You either DID or DID NOT authorize a change, and either way, you MUST respond via one of the methods they have on file for you.  Since I only had one method on file, and it was no longer an option, I was getting nervous.  The internet forums were no help – all the advice people gave involved adding a phone #, etc., which I couldn’t do while locked out.  I tried to find a phone # to call, but came up empty.

Finally, after digging around Microsoft’s web site for a good 10 minutes, I found an option to chat with Microsoft tech support.  Sure, it’s an old, free service (and you generally can expect to get what you pay for), but I figured it was worth a shot, since I had nothing else to lose – all they could do was tell me they couldn’t help…

…which is exactly what happened at first!  But after I explained the situation, and how this was my ONLY option, the support guy relented and gave me a link to a secret page with a long form to fill out, which I could use to prove I am who I say I am.  It asked me things like: 4 or 5 people I’d recently emailed, 4 or 5 recent subject lines, list any subfolders in my inbox, my birth date, and some other personal identifying things.  Then, thankfully, I got an email with a link to a page where I could enter a new password for my account, since my security had been reset.  After creating a new password, I had instant access to my account again, and a week later, they let me have access to change my security settings.  The first thing I did was add a number of other email addresses – some at other free accounts, and some at domains that *I* control, so I won’t ever have to worry about losing access.  Then I added a cell # too.  Hopefully this will stop this from ever happening again!

I have to give Microsoft some credit – I’ve done a lot of these tech chat things, and the guy I got was pretty good.  I just wish I’d saved the URL that I used to contact him, so I could share it with you.  Basically, just search for tech support/help, and try chatting.  If they initially tell you there’s no option to access your account, just calmly explain what an idiot you were for forgetting to change your security info before leaving your job, and hopefully they’ll help you out, like they helped me.

Of course the problem is, sometimes you don’t know ahead of time that today will be your last day on the job.  Sometimes, you just show up one morning to find your desk cleared out and a check in your box.  This is why I say you should never use your work email as a backup security verification email for anything, because you never know when the rug will be pulled out from under you, and you’ll lose access to that account!  Even if you have to open a separate email account somewhere else, DO IT – it’s better to have to look up credentials for logging in to that account once in a blue moon, than trying to change security info involving an account you’ve permanently lost access to.

Live and learn,
–Steve