I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been a

I've posted before on here about my experience getting SIM swapped and how quickly someone was able to gain access to a bunch of my accounts. If I hadn't been at home and looking at my phone while it was happening, it could have been much worse, but thankfully I was able to get in and terminate most of their login sessions before too much damage was done. The one thing I distinctly remember was two of my GMail accounts starting the recovery process. Thankfully, that process apparently gives either 14 or 30 days to stop the recovery and secure my own account. Had I not been connected, that may have been my only saving grace, as I was able to secure those accounts and subsequently use them to recover other compromised accounts. The larger lesson for me was to always use TOTP tokens where possible over SMS, and to completely disable SMS recovery for accounts that didn't have a delay on SMS-only recovery.