Securing your email account: the one that unlocks everything else

Most people rank their email account somewhere below their bank and their phone in order of importance. Attackers rank it first, and they are right to. Almost every other account you own has a button on its login page that says email me a reset link. Whoever controls the inbox controls the buttons.

This guide is about closing that door. It is deliberately practical, and none of it requires you to be technical.

Why the inbox is the master key

Think about what actually happens when you forget a password. The service does not verify who you are in any deep sense. It sends a link to an address on file and trusts that only you can read it. That is the entire security model, and it is a reasonable one — right up until someone else can read your mail.

An attacker who gets into your inbox does not need to break your other accounts. They can simply ask each one, politely, to let them in. Banking, shopping, social accounts, your domain registrar, your cloud storage: all of them, one reset at a time.

This is why a compromised inbox is not one problem. It is every problem you have, arriving at once.

The three settings that do most of the work

If you do nothing else in this guide, do these.

1. Use a unique password nowhere else in your life. Not a variation. Not the one with a different number on the end. Credential-stuffing attacks work by taking a password leaked from some forum you forgot about in 2015 and trying it against your mail provider. A password manager makes this painless; if you would rather not use one, a long passphrase of several unrelated words is far stronger than a short string of symbol substitutions.

2. Turn on the strongest second factor your provider offers. Ranked from best to worst: a passkey or hardware security key, then an authenticator app, then SMS codes. SMS is genuinely better than nothing — do not let anyone talk you out of it if it is all you can use — but it is vulnerable to SIM-swap attacks, where someone persuades your mobile carrier to move your number to their device. If your provider supports passkeys, prefer them. We cover the mechanics in Passkeys explained and the trade-offs between methods in Choosing a two-factor method.

3. Print your recovery codes and store them somewhere physical. Every provider gives you a set of one-time backup codes when you enable two-factor. People generate them, leave them in a downloads folder, and lose them. Put them on paper, in a drawer, with your passport. The single most common reason people avoid strong authentication is the fear of locking themselves out, and recovery codes are the answer to that fear.

The persistence tricks people miss

Here is the part that gets skipped, and it is the reason people get compromised twice.

When an attacker gets into a mailbox, changing the password does not necessarily evict them. Mail systems have a number of features that quietly keep access alive:

• Forwarding rules. A rule that silently copies every incoming message to an outside address. You change your password; they keep reading your mail.
• Filters that hide evidence. A rule that immediately archives or deletes anything containing the words security alert, password, or the name of your bank, so you never see the warnings.
• Alternate recovery addresses and phone numbers. Added quietly, so the attacker can reset your password later at their convenience.
• App passwords and connected third-party apps. Long-lived tokens that bypass your password entirely and often survive a password change.
• Active sessions on other devices. Still signed in, still reading.

Go and look at all five right now, on your main mail account. Every major provider exposes these in its security or settings screens. If you find something you do not recognise, remove it, then change your password, then sign out of all sessions — in that order.

Recognising the attack before it lands

Almost every real-world inbox compromise starts with you typing your password into a page that is not your mail provider. Not a clever exploit — a convincing replica reached through a link.

The reliable defence is a habit rather than a skill: never sign in through a link. If a message claims your account has a problem, do not tap the button. Open your browser or app and navigate to the service yourself. This costs you eight seconds and defeats the entire category.

Passkeys and security keys make this stronger still, because they are bound to the real site's identity and simply will not produce a credential for a lookalike domain. Human vigilance fails occasionally; that binding does not.

For the wider pattern of manipulation these messages rely on — urgency, authority, a plausible reason to hurry — see Recognising social engineering.

Harden recovery before you need it

Recovery is the route back into your inbox, so it needs to be at least as well protected as the sign-in itself. Set it up in this order while you are signed in:

1. Secure the recovery address first. It should be an inbox you actively control, with its own unique password and strong second factor. Do not use this same mailbox as its own recovery address.
2. Review every recovery method on your email account. Replace old addresses and phone numbers, remove anything you do not recognise, and confirm that each remaining method still reaches you. Protect the mobile number with your carrier's account PIN and port-out safeguards where available.
3. Remove routes that can outlive a password change. Revoke unfamiliar connected apps and app passwords, then sign out old sessions. Recheck forwarding and filters after changing access.
4. Generate a fresh set of backup codes after your security settings are final. Providers generally invalidate the previous set when you do this, so replace every stored copy at once.
5. Confirm you can still sign in. Keep your current session open while checking a second trusted device or browser with your normal second factor. Do not use a backup code just to test it; each code is single-use.

A backup-code policy that stays usable

• Keep one printed copy in a locked place you can reach if your phone and computer are unavailable. Do not leave it beside the device it unlocks.
• Never send codes by email or message, put them in a screenshot, or save them in an unencrypted note. If you keep a digital copy, use a reputable encrypted password manager that you can access during an outage of your primary email.
• Treat each code like a spare key: use it only on the provider's real sign-in page, never share it with support or another person, and mark it used without exposing the remaining codes.
• If a code is used, lost, or may have been seen by someone else, generate a new set and destroy every old copy. Review recovery methods and active sessions at the same time.

A quiet risk: the address you abandoned

Many people have an old address at a provider they stopped using, still listed as the recovery address on accounts they still care about. Some providers eventually release abandoned usernames. Others simply have weaker security than the account you have been carefully protecting.

Spend ten minutes auditing which address is on file as the recovery route for your important accounts. If it is one you no longer monitor, update it. An unmonitored inbox is not just a weak link — it is a weak link where nobody hears the alarm.

Account takeover triage timeline: the first 15, 60, and 240 minutes

If you suspect unauthorized access or find yourself locked out, panic is the greatest risk. Execute this structured emergency protocol:

Phase 1: Containment (First 15 minutes)

Action	Objective	How to execute
1. Isolate the device	Prevent malware telemetry	Disconnect potentially infected machines from Wi-Fi; perform recovery from a known-clean phone or family device.
2. Regain credential control	Lock out the intruder	Reset the account password to a randomly generated 20+ character passphrase from your clean device.
3. Terminate all active sessions	Expel unauthorized tokens	Select "Sign out of all web sessions / devices" in Google Account or Microsoft Security dashboard.
4. Revoke OAuth apps & passwords	Cut programmatic access	Navigate to third-party app permissions; delete all existing app-specific passwords and API authorizations.

Phase 2: Persistence eradication (Minutes 15 to 60)

Attackers often plant silent backdoors before you notice the breach so they can re-enter later:

1. Check automatic forwarding rules: Look for hidden rules sending incoming messages to external Gmail/Proton addresses.
2. Review mailbox filters: Attackers frequently create filters with terms like "bank", "statement", "reset", or "verification" set to "Skip the Inbox, Mark as Read, Delete". This hides their activities on other accounts.
3. Verify recovery addresses and phone numbers: Confirm the backup email, SMS number, and account recovery contacts are yours and unedited.
4. Regenerate multi-factor backup codes: Invalidate previous 2FA recovery codes and save a fresh batch to physical paper.

Phase 3: Blast radius triage (Minutes 60 to 240)

Once the inbox is re-secured, protect downstream accounts that use this email for password resets:

• Root Tier 1 (Banking & Investments): Check bank accounts for unrequested password reset alerts or wire authorizations. Call their fraud line if in doubt.
• Root Tier 2 (Password Managers): If your master vault uses this email, immediately change your master password and rotate the secret key.
• Root Tier 3 (Identity & Government): If tax returns, passports, or SSNs are stored in your sent/received mail, place a security freeze with the credit bureaus (Equifax, Experian, TransUnion).
• Communication (Social & Professional): Send a brief advisory to close contacts: "My email was temporarily compromised earlier today. Please disregard any messages or payment requests sent from this address between [Time] and [Time]."

The honest summary

Email security is unglamorous. There is no single setting that makes you safe, and the useful work is a handful of small, boring configuration choices plus one habit about links.

But the leverage is real. An hour spent on the account that can reset all your other accounts is worth more than the same hour spread thinly across everything else you own.

Related reading

• Passkeys explained
• Choosing a two-factor method
• What to do when a phone is lost or stolen
• Recognising social engineering