Ask HN: Help – locked out of longstanding Zoho Mail account
1 comments
A few ideas:
How long has the phone be defunct for? Mobile carriers are obliged to transfer your number to another provider in some cases, so it may yet be possible to recover the number.
Do you have any email clients still logged in on old devices? You could download emails from these if so.
Further to that, does IMAP work? IMAP doesn't usually require 2FA, even if the webmail client does. Google is the big exception there, but hopefully Zoho Mail support one of IMAP's plain text or encrypted password authentication methods, and you can bypass 2FA. Likewise, try accessing the contacts with WebDAV, which I've never had to use 2FA for in the past.
I suggest using Mozilla Thunderbird or Evolution for this. If plain authentication IMAP lets you through, use 'offlineimap' to download the entire mailbox. It only requires a short configuration file to set up, but it gives you a pure Maildir copy.
Finally, and this may get expensive - under certain data protection laws, you have a right to personal data (which includes emails they host). In the EU/UK, companies are not allowed simply to delete the data in response. The tricky thing will be proving your ownership of the account, but if you did not ask for 2FA protection, your password could theoretically be proof enough. Breach of contract for failing to provide access to the service could also be ammunition in a lawsuit. There are solicitors who specialise in this sort of thing.
I feel for you; good luck!
How long has the phone be defunct for? Mobile carriers are obliged to transfer your number to another provider in some cases, so it may yet be possible to recover the number.
Do you have any email clients still logged in on old devices? You could download emails from these if so.
Further to that, does IMAP work? IMAP doesn't usually require 2FA, even if the webmail client does. Google is the big exception there, but hopefully Zoho Mail support one of IMAP's plain text or encrypted password authentication methods, and you can bypass 2FA. Likewise, try accessing the contacts with WebDAV, which I've never had to use 2FA for in the past.
I suggest using Mozilla Thunderbird or Evolution for this. If plain authentication IMAP lets you through, use 'offlineimap' to download the entire mailbox. It only requires a short configuration file to set up, but it gives you a pure Maildir copy.
Finally, and this may get expensive - under certain data protection laws, you have a right to personal data (which includes emails they host). In the EU/UK, companies are not allowed simply to delete the data in response. The tricky thing will be proving your ownership of the account, but if you did not ask for 2FA protection, your password could theoretically be proof enough. Breach of contract for failing to provide access to the service could also be ammunition in a lawsuit. There are solicitors who specialise in this sort of thing.
I feel for you; good luck!
Oh, and one more thing - if all else fails, wait it out. Companies often use a opaque risk estimation strategy for when to require 2FA. Simply having a 'bad' IP address that day could trigger it. They might even just disable 2FA across all their users' accounts if they start losing customers because of it. Therefore, I would suggest just giving it a go every month on into the future; you never know :)
Relying on a free email account and failing to update the associated mobile number were stupid blunders on my part – lessons learned. I had years of (to me) valuable correspondence, contacts, and other data in there. Anything I can still try?