Skip to content
TDACorpIDENTITY
Latest
Sign in

The recovery waiting period

The waiting period that can apply before recovery goes ahead, what you see while it runs, and how to come back when it ends.

On this page

Recovery may not go ahead straight away. When a waiting period applies, it waits first. The waiting period exists for one reason: if someone who is not you has started a recovery, the real owner gets time to notice and stop it before anything about the account changes.

For an account that has a passkey or an authenticator app the wait is 24 hours, and every address on the account is told when it starts; the recovery page says so above the form when you arrive from I lost my passkey. While the wait runs, the hold notice shows exactly when it ends. During it, nothing about your sign-in methods changes, and your account works as it did.

What you see when it applies#

After you open the recovery link and select Continue recovery, the page shows a warning notice instead of taking you on:

Recovery is on hold until a date and time in UTC, written in English as year-month-day hour:minute (another language writes the date out in its own long form), then a short explanation that recovery is held and that you can cancel it from the message we sent if this was not you. Under the notice, a link, Why does this happen, and what do I do?, opens this page. The same link appears under a refused recovery link.

At the same time, a message with the subject Account recovery started: cancel it if this was not you goes to every verified address on the account. It shows when recovery was Started and Held until, and carries a Cancel recovery button. That is how the owner of the account finds out even if they never opened the recovery page. Its wording here is the English; the message is sent in your saved language, otherwise the language the application asked for, otherwise English (Languages). See The recovery email.

While you wait#

Do nothing. You do not need to keep the page open. If it was you, ignore the hold notice; you only use its cancel button if it was not.

If you ask for recovery again during the wait, from the same browser, you receive Your account recovery is on hold. It shows Available after with a time, and no link. Asking again does not shorten the wait or restart it.

If it was not you who asked, cancel. See Cancel a recovery.

When the wait ends#

  1. After the Held until time, open the recovery page in the same browser you asked from, and ask for recovery again.
  2. You receive a new Recover your TDACorp Identity account message, with a new Start recovery link. The old link no longer works.
  3. Open the new link in the same browser and select Continue recovery.
  4. You are taken to Secure your account. See Secure your account.

Coming back from the same browser matters. The new link is meant for the browser that made the request, and a different browser needs to ask again. The same goes for the first link: a recovery link only opens in the browser where you asked for recovery. A mail app's built-in browser counts as a different browser, so copy the link from the email and paste it into the address bar of the browser you asked from. Do not wait too long after the hold ends: a held recovery is not kept open forever, and an expired one has to be started again.

Why a new link is needed#

Proving that you can read the mailbox again, after the wait, is part of the protection. A browser that asked for recovery earlier cannot finish by itself if someone else later sits down at it. The mailbox has to answer a second time.

What can go wrong#

What you seeWhat it means
Recovery is on hold until a timeThe wait is still running. Come back after that time.
This link only works in the browser where you started the recovery. Open it there, or start the recovery again in this browser.The link was opened in a different browser, for example inside a mail app. Open it in the browser you asked from, or ask for recovery again there.
This recovery link is not valid any more. Start again.The link expired, was used already, or was opened in a different browser. Start again from the browser you want to use.
Your account recovery is on hold (email)You asked again too early. Wait until Available after.

Related#

Verified against commit c5ef357