Somebody stole my phone and changed my email password. I’ve tried to recover it, but I don’t have the phone number linked to my account because my phone was stolen. What should I do? Tay

First, recover your phone number, which is much more important than the phone.

When a phone is either lost or stolen, you should immediately contact your mobile network provider to tell them what’s happened. They should then suspend the current sim and send you a replacement sim with the same phone number. This service should be free but sometimes incurs a nominal charge. It won’t get your phone back, but it will make it harder for the thief to log on to your accounts and change your passwords.

Some network providers can also block your handset’s IMEI (International Mobile Equipment Identity) number. This makes it harder for the thief to use your phone with a different sim.

Of course, you will need to be able to show that you own your phone number, and different companies may have different systems for different types of account. My advice is to be prepared. I wasn’t, and it wasn’t fun.

Phone number recovery

When I lost my phone in November – I left it on a plane in Kuala Lumpur – I phoned O2 but couldn’t pass the recovery tests, which included providing some numbers I’d dialled in the past three months. Being 6,500 miles from home, I couldn’t look up the phone number of my window cleaner, whose surname I couldn’t remember.

Back in the UK three weeks later, an O2 store refused to accept any other evidence that I owned this pay-as-you-go number, which was originally supplied by BT Cellnet before O2 was launched in 2002. It was on my business cards, in ancient emails, in online media databases and so on. I could also prove I owned the bank account that paid for its minutes. O2 wouldn’t budge. Only after digging out my window cleaner’s phone number did I eventually get a replacement sim.

Not carrying around a written list of the numbers I’d dialled was clearly a bad mistake on my part, but full marks to O2 for using the Data Protection Act to put my personal data at risk.

If you have not yet lost your phone, or had it stolen, I strongly suggest that you find out what will happen if you do. You could easily lose a number you’ve used for 20-odd years.

Mitigating steps

While trying to recover my number, I took steps to limit the damage someone could do if they were able to use my lost phone. You should likewise log on to any other accounts that hold your phone number, such as Facebook, LinkedIn, Twitter and so on, including any mobile banking or payment systems. Set up and confirm an alternative email address as a way of recovering your accounts, delete the compromised phone number, and change your passwords before the thief can do the same thing.

You can also try to disable or erase your phone remotely, via the web. If it’s an iPhone, log on with your Apple ID and use Lost Mode, which is part of Find My Phone. If it’s an Android phone, log on to your Google account and go to Find My Device.

This does depend on certain conditions, one of which is that the lost or stolen phone must have a mobile or wifi network connection.

I did try to erase my lost phone, because it was backed up to Google Drive. I failed because, as far as I could tell, it was never switched on. It may still be flying between London and KL …

Email recovery

You didn’t mention which email service you were using, but most of them take the same approach. That is to say, you go to a web page and fill in a form to recover your email address.

Forms typically ask for your email address, any passwords you remember, the answers to various security questions (the name of your first pet, or whatever), and the subject lines and email addresses of people you’ve emailed. In Microsoft’s case, you can also provide the names of three Skype contacts.

You can also create unique security codes to use if you lose or forget your email password. Microsoft lets you generate a single code from its Additional security options page, while Google lets you create 10.

If you are trying to recover an email address, you will usually need to provide a second email address so the company can contact you.

It helps if you fill in the form with a device that you have used previously with the account you’re trying to recover, and from the same place, such as your home network. Mail services now keep records of the devices and IP addresses you use (Google, Microsoft). Indeed, they may well challenge you if you log on with a different device, or from a different country.

If you normally download and answer your emails on a PC, you should not have a problem: you will have hundreds or even thousands of contact names and subject lines. If you only use email in a web browser, it may challenge your memory. One solution would be to screen-grab your inbox once a month, but it would be better to backup your emails, as explained below.

Unfortunately, there are no technical tricks to recovering an email address. All you can do is provide as much information as possible, and as many different kinds of information as possible, even if some of it is slightly wrong.

The real problem is that password resets and email recovery systems are usually the easiest way to hack someone’s mailbox. You have to do better than a would-be hacker to get past the automated mailbox recovery software, and hackers who have studied your social media accounts can be very convincing.

Taking steps…

If you really want to be able to recover a mailbox, you need at least three ways to verify your account, on top of any security questions. For a start, you must have an alternative email address, and two is better. You should also have a mobile phone number, and possibly a landline number. All of these have to work, and you have to keep them all updated. It’s extra work, but it’s better than losing access to your main mailbox.

If you use a school, university or work address as a recovery account, you may no longer have access to it a few years later, when you need it.

When it comes to security questions, people have been hacked because their answers could be found from web searches or their social media accounts. Your mother’s maiden name, past schools or the names of your pets may already be known, or easy to guess.

This is an argument for providing nonsensical answers: nobody will guess that your favourite teacher was called 23o;Aif99#. But you will have to keep records of fake answers because you won’t be able to guess them either.

People often recommend two-step or two-factor authentication (2FA), but if this involves your email provider sending a one-time code to your mobile phone, then you’re in trouble if you lose the phone. Also, 2FA users can still fall victim to phishing attacks. It would be better to use a YubiKey, like Facebook and Google employees. Just make sure you have a backup YubiKey in case you break or lose the first one.

Mail backups

The risk of losing access to all your emails means you should have them backed up. For example, you could download all your emails to a PC program such as Microsoft Office Outlook, eM Client or Mozilla’s Thunderbird. You could use MailStore Home 11 for Windows, which is free for home users, or Mail Archiver X, which is $39.95 for Mac users. You could back up your Gmail with Gmvault, and restore it to a different Gmail account.

For an extra backup, I’ve set my main mailbox to forward all incoming emails to my backup mailbox. The key trick is to remember, when you reply to emails, to bcc a copy to the backup account.

I wouldn’t like to lose access to my main email account, but at least I wouldn’t lose any emails.

Have you got a question? Email it to Ask.Jack@theguardian.com