Chapter 2

The 4-tier anti-lockout model

2.1 Learning objectives

Describe the 4 tiers ROOT, CORE, BRANCH, LEAF and the role of each.
Place your own accounts and devices in the right tier.
Apply the one-way recovery principle: lower tiers recover toward upper tiers, never the reverse.

2.2 Concepts

Every component of your digital life is divided into 4 tiers. The tiers are not equal and are not protected the same way. Goal: accept controlled loss, avoid cross-locking, always have a "last anchor".

Tier	Role	Example components	If lost
ROOT – Lifeline anchor	Root identity; the final point for proving "I am me"	Legal identity documents; a domain registered in your name	Loss = almost everything gone; must be extremely stable
CORE – Heart	Holds all passwords and 2FA factors	Password manager; hardware security keys; a separate TOTP app	Loss = must recover from ROOT; painful but survivable
BRANCH – Buffer	Email, infrastructure, important services	Email on your own domain; registrar account; NAS; cloud accounts; operating-system accounts	Can be lost temporarily; recovers to CORE/ROOT
LEAF – Leaves	Apps, SaaS, social networks, tools	Note apps, design tools, forums	Allowed to die; can be recreated

Four operating principles

Few things at the top. ROOT has only 1–2 components. CORE as lean as possible.
One-way recovery. LEAF recovers via BRANCH/CORE; BRANCH recovers to ROOT; never the other way.
No self-dependency. No tier may depend on something stored inside itself.
The top stays quiet. ROOT components are rarely used, never used for daily logins, never handed to AI.

Two ways to choose ROOT

Approach	Description	Advantages	Risks to manage
ROOT is a big-platform account	An account with a large tech company that has human support and recovery contacts	Easy to start; the company has a recovery process	The company can lock the account under its own policies; you are not in control
ROOT is legal identity + your own domain	Identity documents prove ownership of the domain; the domain can recreate email	You own it and can switch providers	An expired or illegally transferred domain breaks the chain; you must manage renewals, transfer lock and registrant details

Neither approach is absolutely right. What matters is knowing which one you chose and managing that approach's risks properly. This course goes deeper into the second approach in Chapter 3, because it gives control to the user.

2.3 Worked example

After the incident, Mr. A rebuilt along the 4 tiers:

Tier	Mr. A's components
ROOT	National ID card; the domain example.vn registered in Mr. A's name
CORE	Password manager (master password memorized by Mr. A; secret key printed on paper and stored on an offline USB); 2 hardware security keys; TOTP for the password manager in a separate app
BRANCH	Email ***@example.vn; domain registrar account; DNS account; NAS at home; cloud accounts; phone/computer operating-system accounts
LEAF	Social networks, note apps, design tools, services being tried out

Mr. A's way back: lose the registrar account → bring his ID card to the registrar (or transfer to another registrar) → regain example.vn → recreate the mailbox ***@example.vn → use that mailbox to recover the password manager and the BRANCH accounts.

Case: a colleague loses an iPhone and is then tricked into signing in to iCloud

Note: the following describes the typical course of this kind of scam after an iPhone is lost, used for teaching.

Context. A colleague loses an iPhone. This can happen anywhere: in a car, at a café, in a crowded place.

Typical course of events.

After losing the phone, the owner receives an SMS/iMessage or email claiming to be from "Apple" or "Find My", saying the iPhone has been found and inviting them to tap a link to see its location.
The link leads to a fake page that looks like the iCloud/Find My sign-in page. It asks for the Apple ID, password, and then the 2FA verification code.
The scammers immediately use the captured details to sign in to the real account and remove the device from Find My / the account, i.e. remove Activation Lock. They then erase the phone to sell it or unlock it to use.
The owner usually only notices when the device disappears from the device list, or when an email arrives about account changes. By then the phone may be gone for good, and if the scammers managed to change the recovery details, access to the account is lost too.

Link to the 4-tier model.

The iPhone is a device, but the Apple ID is BRANCH. Losing the phone is losing one device; Activation Lock keeps the phone tied to the Apple ID, so the thief cannot use it right away. This scam targets the BRANCH tier (the operating-system account), not the phone.
The 2FA code belongs to the CORE tier. By entering the 2FA code into a fake page, the owner hands an upper-tier key to a stranger. Principle: never enter a password or verification code into a page someone else led you to.
One-way recovery. The Apple ID recovery path must lead to CORE/ROOT that the owner controls (password manager, trusted phone number, email on your own domain), not depend on the very iPhone just lost. If the iPhone is the only trusted device, losing it also loses the recovery path: a "self-dependency" error.
The top stays quiet. The "your phone was found" message creates urgency so the owner uses the upper tier immediately. The right reflex is to open Find My yourself or type icloud.com/find yourself, never tap the link.

The right steps when you lose an iPhone

The steps below are based only on Apple's official guidance (support.apple.com, checked on 24/10/2026).

Locate the device with Find My. Use the Find My app on another Apple device, a device of someone in your Family Sharing group, or type icloud.com/find yourself. Signing in to icloud.com/find does not require a verification code, so it still works when your trusted device is lost.
Mark As Lost (Lost Mode). Turn it on as early as possible. The device is locked with its passcode and Apple Pay cards are suspended. If the device was stolen, Apple advises not to put contact information on the lock screen, because thieves can use it to scam you.
Do not remove the device from Find My or from your account, even after erasing it remotely. Removing it removes Activation Lock, helping the thief erase and resell it. If you have AppleCare+ with Theft and Loss, do not remove the device until your claim has been approved.
Do not try to retrieve the device yourself. If it appears on the map somewhere unfamiliar, report it to the police (local law enforcement). They may ask for the device's serial number.
Contact your carrier to report the loss and request suspension of service (SIM lock).
Change your Apple ID password and review the account. On another trusted device or at account.apple.com: check the device list, email addresses, trusted phone numbers and recovery methods. If you see unfamiliar changes, fix them and change the Apple ID password. If Find My was not enabled on the device, change the Apple ID password immediately.
Erase the device remotely once you have tried everything to recover it (this cannot be undone). Still keep the device in Find My.
Beware of messages impersonating Apple. Apple never contacts you to say your iPhone has been found. Do not share your device passcode, password or verification codes with anyone; do not enter them into a website someone sent you. You can forward suspicious emails, or screenshots of suspicious SMS messages, to reportphishing@apple.com.

Official Apple sources:

If your iPhone or iPad was stolen: https://support.apple.com/en-us/120837
How to find your lost iPhone or iPad: https://support.apple.com/en-us/101593
Mark a device as lost in Find My on iPhone: https://support.apple.com/guide/iphone/mark-a-device-as-lost-iph7cc193cfc/ios
Use Lost Mode in Find Devices on iCloud.com: https://support.apple.com/guide/icloud/use-lost-mode-mmfc0f0165/icloud
Recognize and avoid social engineering schemes: https://support.apple.com/en-us/102568
What to expect when in contact with Apple Support: https://support.apple.com/en-us/120569

2.4 Common mistakes

Putting too much in ROOT, e.g. using the ROOT account to log in to every service.
Logging in to infrastructure (registrar, DNS) with an email hosted on the very domain that infrastructure manages.
Cross-recovery between accounts in the same tier.
Protecting LEAF with heavy ROOT-level measures, increasing lockout risk for no good reason.

2.5 Checklist

I have written a list of components for each tier.
ROOT has no more than 2 components.
Every BRANCH component has a recovery path leading to CORE or ROOT.
No component is recovered by itself.

2.6 Exercises

Sort 20 accounts you use into the 4 tiers. How many are really LEAF?
Write your way back, starting from "I lost all my devices".
Pick one of the two ways to choose ROOT in section 2.2 and write 3 measures for managing its risks.

2.7 Summary

The 4 tiers are not equal; protect by tier, not uniformly.
Recovery flows one way, toward ROOT.
"Leaves are allowed to die"; ROOT is not.

I have finished this section