What to do if…
you are locked out of an account because you cannot complete a verification step

What to do now

1. Treat the lockout as possibly hostile until you know otherwise.
   If you received unexpected verification prompts, password-reset emails, SIM change notices, new-device alerts, or messages about security settings changing, assume someone may be trying to take over the account.

2. Secure the email account that controls recovery.
   If you can still access the linked email inbox, sign in from a device you have used before. Change the email password, check forwarding rules and filters for anything you did not set, and turn on 2-step verification if you can do so without losing access.

3. Secure the phone number used for codes.
   If your phone was lost, stolen, replaced, or suddenly lost signal, contact your mobile network provider using its official website, app, or known customer-service route. Ask them to help you regain control of the number and check for an unauthorised SIM change or account change.

4. Use the provider’s official recovery path.
   Go to the provider’s official website or app directly. Look for options such as “try another way”, “I no longer have access”, “use backup codes”, “use a trusted device”, “use a passkey”, or “contact support for account recovery”.

5. Try recovery from familiar conditions.
   Use a previously trusted device, your usual browser, and your usual location if you safely can. If you have printed recovery codes, saved backup codes, a password manager entry, or a trusted device still signed in, use those before opening new support routes.

6. If it is a work, school, or university account, contact the administrator.
   Stop solo troubleshooting and ask IT or the helpdesk for account recovery or identity verification. Many managed systems need an administrator to reset or override a stuck verification method.

7. If it is a bank, benefits, tax, pension, or other essential account, use an official phone or in-person route.
   Use a phone number from the back of your card, official paperwork, the official app, or the official website typed directly into your browser. Say: “I cannot complete your verification step. I need an alternative verification method and I am worried about account security.” Ask them to note the account and explain any temporary safety blocks they can apply.

8. Write a short evidence log.
   Record the date and time, the account affected, what verification was demanded, any error message, any unexpected security notice, any money movement you did not make, and any support or complaint reference number.

9. Report suspected fraud or cybercrime through the right UK route.
   If a crime is happening now or there is immediate danger, call 999. For fraud or cybercrime in England, Wales, or Northern Ireland, use Report Fraud. If you live in Scotland or the crime happened there, contact Police Scotland on 101. If the issue is only a suspicious email, message, call, social media contact, or website and you have not lost money or responded, use the suspicious-reporting route.

10. If the provider keeps saying you cannot verify, ask what formal route exists.
    Ask for the provider’s account recovery process, complaint process, and any secure alternative verification options. If the organisation is subject to UK data protection law, a Subject Access Request may help you get copies of personal data they hold about you, but it is not a guaranteed way to unlock the account. Organisations normally have one calendar month to respond once they have what they need from you; complex or multiple requests may take longer.

11. For a regulated financial firm, use its complaint process if recovery stalls.
    Complain to the firm first. If you receive a final response you are unhappy with, or you have had no response within eight weeks, you can generally ask the Financial Ombudsman Service to look at the complaint. There are time limits, including a usual six-month limit from the date of the final response.