diff --git a/README.md b/README.md
index 053a748..abcb4eb 100644
--- a/README.md
+++ b/README.md
@@ -137,14 +137,17 @@ npm run creator
 # With referral link (earn rewards credit)
 npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE&ref=rafsrchae
 
-# With recovery email for account security
+# With recovery email (will prompt for verification code)
 npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -r backup@gmail.com
 
-# With 2FA enabled automatically
+# With 2FA enabled (will prompt for QR code scan)
 npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE --2fa
 
-# Full automation mode (skip all prompts)
-npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -r backup@gmail.com -y --2fa
+# Skip all prompts (no recovery email or 2FA)
+npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -y
+
+# Full security with auto-accept (requires manual code/QR scan)
+npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -r backup@gmail.com --2fa -y
 ```
 
 **✨ Features:**
@@ -162,8 +165,20 @@ npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -r backup@gmail.co
 **🎛️ Command Arguments:**
 - `<url>` — Referral URL (optional)
 - `-r <email>` — Recovery email address
-- `-y` — Auto-accept mode (skip prompts)
-- `--2fa` — Enable 2FA automatically
+- `-y` — Auto-accept mode (skip interactive prompts)
+- `--2fa` — Enable 2FA setup
+
+**⚙️ How Flags Work:**
+
+| Command | Recovery Email | 2FA | Notes |
+|---------|---------------|-----|-------|
+| `npm run creator` | ❓ Prompts | ❓ Prompts | Interactive mode |
+| `npm run creator -y` | ❌ Skipped | ❌ Skipped | No security features |
+| `npm run creator -r email` | ✅ Uses email | ❓ Prompts | Only recovery |
+| `npm run creator --2fa` | ❓ Prompts | ✅ Enabled | Only 2FA |
+| `npm run creator -r email -y` | ✅ Uses email | ❌ Skipped | No prompt for 2FA |
+| `npm run creator --2fa -y` | ❌ Skipped | ✅ Enabled | No prompt for recovery |
+| `npm run creator -r email --2fa -y` | ✅ Uses email | ✅ Enabled | Full automation |
 
 **📋 What happens:**
 1. Creates Microsoft account (email, password, birthdate, names)
diff --git a/src/account-creation/AccountCreator.ts b/src/account-creation/AccountCreator.ts
index 06cd879..b0952a5 100644
--- a/src/account-creation/AccountCreator.ts
+++ b/src/account-creation/AccountCreator.ts
@@ -631,17 +631,23 @@ export class AccountCreator {
       let recoveryCode: string | undefined
       
       try {
-        // Setup recovery email if requested
-        const emailResult = await this.setupRecoveryEmail(confirmedEmail)
-        if (emailResult) recoveryEmailUsed = emailResult
+        // Setup recovery email (interactive if no -r flag and no -y flag)
+        if (this.recoveryEmail || !this.autoAccept) {
+          const emailResult = await this.setupRecoveryEmail(confirmedEmail)
+          if (emailResult) recoveryEmailUsed = emailResult
+        } else {
+          log(false, 'CREATOR', 'Skipping recovery email setup (-y without -r)', 'log', 'gray')
+        }
         
-        // Setup 2FA if requested
+        // Setup 2FA (only if --2fa flag OR interactive prompt accepts)
         if (this.enable2FA || (!this.autoAccept && await this.ask2FASetup())) {
           const tfaResult = await this.setup2FA()
           if (tfaResult) {
             totpSecret = tfaResult.totpSecret
             recoveryCode = tfaResult.recoveryCode
           }
+        } else {
+          log(false, 'CREATOR', 'Skipping 2FA setup', 'log', 'gray')
         }
       } catch (error) {
         log(false, 'CREATOR', `Post-setup error: ${error}`, 'warn', 'yellow')
@@ -2208,7 +2214,7 @@ ${JSON.stringify(accountData, null, 2)}`
   /**
    * Setup recovery email for the account
    */
-  private async setupRecoveryEmail(currentEmail: string): Promise<string | undefined> {
+  private async setupRecoveryEmail(_currentEmail: string): Promise<string | undefined> {
     try {
       log(false, 'CREATOR', '📧 Setting up recovery email...', 'log', 'cyan')
       
diff --git a/src/account-creation/README.md b/src/account-creation/README.md
index 320728d..ad92cbb 100644
--- a/src/account-creation/README.md
+++ b/src/account-creation/README.md
@@ -54,20 +54,32 @@ npm run creator https://rewards.bing.com/welcome?rh=YOUR_CODE -r backup@gmail.co
 | `-y` | Auto-accept mode (skip prompts) | `-y` |
 | `--2fa` | Enable 2FA automatically | `--2fa` |
 
+**⚠️ Important: How `-y` Works**
+
+The `-y` flag **skips interactive prompts**, but **respects the flags you provide**:
+
+- `npm run creator -y` → Skips recovery email AND 2FA (nothing setup)
+- `npm run creator -r email@example.com -y` → Uses recovery email, skips 2FA
+- `npm run creator --2fa -y` → Skips recovery email, forces 2FA
+- `npm run creator -r email@example.com --2fa -y` → Uses both (full automation)
+
 **Examples:**
 
 ```bash
-# Minimal (no options)
+# Minimal (no options, will prompt for everything)
 npm run creator
 
-# With referral only
+# With referral only (will prompt for recovery email & 2FA)
 npm run creator https://rewards.bing.com/welcome?rh=B395E9D7
 
-# With recovery email (will be asked for code)
+# With recovery email (will be asked for code, then prompts for 2FA)
 npm run creator -r mybackup@gmail.com
 
-# Full automation with 2FA
-npm run creator https://rewards.bing.com/welcome?rh=B395E9D7 -r backup@gmail.com -y --2fa
+# Full automation with 2FA (no prompts, but requires manual code entry)
+npm run creator https://rewards.bing.com/welcome?rh=B395E9D7 -r backup@gmail.com --2fa -y
+
+# Skip everything (fastest, no security features)
+npm run creator https://rewards.bing.com/welcome?rh=B395E9D7 -y
 ```
 
 ### Interactive Flow