If you could protect only one account, it should be your email. This guide explains why. It is part of our guide to securing your key accounts.
How one inbox opens everything
Nearly every website lets you reset a forgotten password through email. That is convenient, and it also means that your inbox can override your other passwords.
So an attacker who gets into your email can:
- Search for messages from banks, shops and social networks.
- Press "forgot password" on those sites.
- Open the reset link in your inbox.
- Delete the evidence, or hide it with a filter.
A perfectly strong bank password can be bypassed in this way, if the bank lets you reset it by email.
What else your inbox holds
Your email is also a detailed record of your life:
- Bills, tax documents and bank statements.
- Copies of ID, tickets and addresses.
- Private conversations.
- Your contacts, who can be scammed in your name.
- Invoices that criminals can use to redirect payments.
Why attackers love it
An email account can be used to impersonate you, reset accounts, or fuel further scams. It also often carries the login for your Apple or Google account, which controls your phone and backups.
What to do
| Protection | Why |
|---|---|
| A long, unique password | Stops credential stuffing |
| Strong two-factor login | Stops a stolen password from being enough |
| Up-to-date recovery details | Stops you getting locked out |
| Regular check of forwarding rules | Reveals hidden access |
| No reused old inboxes | Closes forgotten doors |
Our step-by-step email security checklist covers each of these.
Consider a separate address
Many careful people keep one private address for banks, password managers and exchanges, and a different one for newsletters and shopping. A leaked shopping address then tells attackers nothing about your bank login.