The only rules of thumb I can come up with are these: 1) Log in on everything now and then (hm, maybe gotta so that myself soon); and perhaps even more importa

The only rules of thumb I can come up with are these: 1) Log in on everything now and then (hm, maybe gotta so that myself soon); and perhaps even more important, 2) When getting a new device / phone number / email address, log in to everything from the new one before getting rid of the old one. That way, you can jump back to the old and confirm the validity of the new. Then set up the new phone number for 2FA / email as your backup address / recognised login device... Only then can you dispose of the old.