The Spare Key Question: Rehearsing Crypto Account Recovery While Calm

Most UK crypto holders spend their preparation on the market. They read about volatility, set rough price alerts, and perhaps decide how much of a portfolio should sit in stablecoins. Far fewer rehearse the moment that matters just as much: when the email account tied to a crypto platform stops accepting the password, when a mobile number is ported without warning, or when a trusted device is lost. In November 2026, access is the quiet dependency beneath every crypto account. A recovery audit is simply a calm look at how you would get back in, before you need to.

Why rehearse access at all?

Crypto platforms are not banks in the ordinary high-street sense. Many firms serving UK customers are registered with the Financial Conduct Authority for money-laundering purposes, but that is not the same as deposit protection. If access fails, there is rarely a branch manager to speak to and no counter to visit. The relationship is mediated by an email address, a phone number, an authenticator app, a device and a support queue.

That is why access deserves the same attention as allocation. A portfolio that cannot be reached is not a portfolio in any practical sense. The aim of a recovery audit is not to frighten anyone or to suggest that platforms fail routinely. It is to remove surprise. A person who has already thought through the route back in is less likely to make a rushed decision when the screen says the password is wrong.

What recovery actually involves

Recovery is not one action. It is a chain. A password reset may depend on an email account. A two-factor reset may depend on a phone number or a backup code. A full account restore may depend on identity documents and a human support agent. A trusted-device review may depend on a device you still possess.

A route is only real if it works without the thing you have lost. If the backup code is stored only on the phone that has been stolen, it is not a backup. If the recovery email is an old university address, it is not a route. This is the spare key question: where is the second way in, and would it survive the first failure?

The 30-minute audit, in three passes

Set aside half an hour and treat it as an administrative task, not a security panic. A notebook or a simple document is enough. Do not write passwords, one-time codes or wallet recovery phrases in it.

First pass: map the routes

List each crypto account you genuinely use. For each one, note the email address, the phone number, whether an authenticator app is in use, where backup codes are kept, which devices are trusted, and which identity document was last provided. This is a map, not a keyring. The purpose is to see dependencies clearly. Many readers will find that three accounts depend on one email address, or that a phone number changed months ago and was never updated.

Second pass: test the contact methods

Check that the email address still receives messages and that the phone number is current. Confirm that you can access the authenticator app or its backup route. If you use a mobile number for security, ask your provider about account protections and be alert to SIM-swap risks. Do not click links in unexpected messages that claim to be from a platform. Go to the official app or type the domain yourself.

This pass is also the moment to check whether a recovery email is controlled by someone else, or whether an old address has been abandoned. A dormant email account is a weak link, not a convenient one.

Third pass: check documents and support escalation

Identity documents expire. A passport or driving licence that was accepted at sign-up may no longer be current when a support agent asks for verification. Note the document type, its expiry date and where it is stored. Then find the platform's official support page and note how escalation works. Look for a complaints route, a reference-number process and any published response times.

Do not begin a support conversation through a search advertisement or a social-media reply. Type the platform's domain into the browser and navigate from there. A recovery path that starts with an advert is not a recovery path; it is an invitation.

Rehearse, do not rupture

There is a difference between checking a route and deliberately breaking it. Do not enter wrong passwords repeatedly, remove two-factor authentication unnecessarily, or simulate a lockout on a live account. Those actions can trigger security freezes and create the very problem you are trying to prepare for. The rehearsal is a reading exercise: confirm that the backup codes exist, that the contact methods work, that the documents are current and that the support route is understood.

It is also sensible to repeat the audit after a change of phone, email address, device or name. These are the moments when recovery routes quietly fall out of date.

When panic is the product: recovery scams

Scammers understand that a locked-out account holder is anxious. They monitor social media for complaints and then appear as helpful support agents. They may ask for a password, a one-time code, a wallet recovery phrase or remote access to a device. They may offer a paid recovery service, request payment in crypto, or send a screen-sharing link.

A genuine platform will not ask for your password or a live two-factor code. It will not ask you to install remote-access software to fix an account. It will not demand payment to release a balance. If someone contacts you first and creates urgency, stop. Use the official app or website, and report suspected fraud to Action Fraud. The National Cyber Security Centre publishes guidance on recognising and reporting scams, and the FCA warning list is a useful cross-check for unfamiliar firms.

What to record, and what to leave out

Keep a recovery map that lists account names, the email and phone routes used, where backup codes are stored, document expiry dates, and the date of the last check. Record support reference numbers if you have contacted a platform. Do not record the codes themselves, passwords or wallet phrases in the same file.

A paper copy in a locked drawer or a note in a reputable password manager is a decision for the individual household. The important point is that the map is available when the usual device is not. A recovery plan stored only on the device you have lost is a plan with a single point of failure.

A final note on self-custody

This audit concerns exchange and app accounts. Self-custody wallets work differently. A wallet recovery phrase is not an account password, and no support agent should ever ask for it. The same principle applies: know where the spare route is, test that it exists, and never hand it to someone who contacts you first.

At JaagCoin, we treat recovery as beginner safety rather than advanced security. The goal is not to live in fear of losing access. It is to make access legible, so that a lost phone or a changed email is an inconvenience rather than a crisis. Thirty minutes, once a year or after a major change, is a modest price for that clarity.