I have now seen Google Account Recovery ask for a code sent to my recovery phone, followed by a code sent to my recovery email address.

The rest of this post aims to reinforce the answer above, and describe my test methods. If you are planning for Google Account Recovery, please read the article from Google first: Avoid getting locked out of your Google Account.

Google Account Recovery is expected to vary between different cases. It uses case-by-case risk assessments. The system is not completely documented, because it is a security system, it is complex, and it will be tweaked over time.

If you are tempted to test Account Recovery yourself, please be very careful not to risk your main account, or make it harder to recover later.

1. Account Recovery sometimes requires more than one piece of information
2. Account Recovery sometimes allows you to use your recovery email address
3. My personal setup

1. Account Recovery sometimes requires more than one piece of information

In some cases, Account Recovery succeeded using only a recovery phone number or a recovery email address - and no password. This happened even though 2-Step Verification was turned on. Also, I was testing using a private browsing window, to avoid being remembered as a "trusted device". This puzzled me at the time. I now believe this was due to using a "familiar location".

2-Step Verification has become more common, as it has been automatically enabled for millions of users. See the 2022 blog post, "Making you safer with 2SV".

Coincidentally, we see various anguished support requests in 2022 and 2023.

In my latest test, I used Tor Browser. Google Account Recovery saw me as coming from a different country, as confirmed by Google starting off in a different language. In this test, using my recovery phone on its own did not let me recover my account and reset my password.

I think using a "familiar location" is helpful. However, it is not as reliable as we might wish. If your internet provider changes your IP address, for example, Account Recovery will not see it as the exact same location. I have seen Google consider a sign-in as "suspicious" after changing internet provider.

2. Account Recovery sometimes allows you to use your recovery email address

In some cases, Account Recovery offers to send a verification code to your recovery email address. This includes some cases where it asks for a code sent to your recovery phone, and a code sent to your recovery email.

In other cases, it does not allow using your recovery email at all.

Here is one example of an anguished post, by someone who has a password, and their recovery email, but not their recovery phone: phone changed; have recovery email but Google doesn't give option to use it for verification

We might be less sceptical of community support experts now :-). So I note this post:

There are an almost infinity number of conditions that could trigger additional verification or account recovery and Google has a large number of responses. It's impossible to say which is more important for all possible conditions (which is why you should have both), but in general, Google relies more on a phone than an e-mail. -- /u/bkc56, moderator of /r/Gmail and unofficial "Product Expert"

This makes sense, considering that you cannot add email as an official method in the list of "second steps", under myaccount.google.com > Security > "How you sign in to Google" > "2-Step Verification". In contrast, Google positively encourage you to add a phone number as one of the options when you turn on 2-Step Verification.[*]

[*] Except if you enable Advanced Protection, you must use security keys or passkeys for 2-Step Verification. In that case you cannot use a phone number for 2-Step Verification.

If Account Recovery does not mention your recovery email address, a last resort is to check you are not logged in on any active device, and then wait up to a week for Account Recovery to notice. At least this would make sense, but I can't confirm it.

For example, if Account Recovery believes you are still logged in on a phone somewhere, it can insist you verify using a "Google Prompt".

Sometimes, it sends a verification code to the same Gmail account that you are trying to recover. I suspect this method is specifically intended for 2-step verification. If you do not have 2-step verification enabled, you might not see this.

I have also seen Account Recovery send a "Google Prompt" to a phone which was logged in to my recovery gmail address.

You can see how Google might consider it more secure to wait and see if your recently lost phone is truly dead. As opposed to immediately trusting some email inbox you provided years ago, that Google might not know anything about.

Another issue I had when testing Account Recovery, is that it refused to use a recovery email immediately after I added (and "verified") the recovery email. The new recovery email seems to start working within 24 hours. Although, I have not tried with Tor yet. I guess this is a security feature. (There is an email notification: "The recovery email for your account was changed. If you didn't change it, you should check what happened.").

I have also seen the recovery email address labelled as "verification needed" in some cases. It makes sense to fix this if you see it. However, this does not necessarily stop you using the recovery email to recover the account. See: "The recovery email address for my Google account is marked as "verification needed". What happened?"

3. My personal setup

I've been interested enough to set up a recovery email address using Outlook.com. I have access to the recovery email inbox on my devices, and my devices will warn me if it breaks.

(I added the Outlook.com email inside the Gmail Android app. To fix a "duplicate username" error in the Gmail Android app, I had to make sure that the "primary alias" of my Microsoft Account was not set to my Gmail address.)

My main reason for this is to receive copies of Google security alerts, in a second inbox where it will be harder to delete them or lock me out.

I am unlikely to rely on the recovery email for Account Recovery, because I have other backup methods prepared. But having it makes Google happier. Maybe it will be handy if Google detect a "suspicious sign-in". Or in some other case I am not aware of.

Google advise the recovery email should be one that "you use regularly" - so not someone else's email.