Your email account can reset the password of nearly everything else you own — banking, social media, shopping. Compromise the inbox, and the attacker owns it all. Protect it like the master key it is.
Why Email Is Target #1
Password resets flow through email. An attacker in your inbox can request resets for your bank, crypto, and social accounts, intercept the reset links, and lock you out — all in minutes.
1. A Unique, Strong Password
Your email password must be unique (never reused) and long. A passphrase from your password manager is ideal. This single password guards everything downstream.
2. Enable the Strongest 2FA Available
Authenticator app or hardware key — not SMS if you can avoid it. Email providers all support app-based 2FA; turn it on today.
3. Set Up Account Recovery Properly
- Add a recovery email and phone number you actually control.
- Save backup codes on paper, stored safely.
- Review recovery options yearly — old phone numbers are a classic lockout/hijack vector.
4. Learn to Spot Phishing
Your inbox is where phishing lives. Unexpected password-reset emails you didn't request, "security alerts" with links, attachments from unknown senders — verify through official apps/sites, never through the email's links. (See our phishing guide.)
5. Don't Use Your Main Email Everywhere
Consider email aliases or a second address for signups, newsletters, and forums. Fewer places holding your primary address means fewer breach and spam vectors.
6. Review Connected Apps and Sessions
Check which third-party apps have access to your Gmail/Outlook (Settings → Security → Third-party access) and revoke anything you don't recognize. Do the same for active sessions on unknown devices.
7. Encrypt Sensitive Emails
Standard email is not encrypted end-to-end. For truly sensitive content, use encrypted services or PGP — and never send passwords or ID scans by plain email.
8. Watch for the Warning Signs of Compromise
Sent emails you didn't write, login alerts from unknown locations, changed recovery settings, contacts getting spam "from you" — act immediately: change the password (from a clean device), revoke sessions, enable 2FA, and check forwarding rules (attackers often add silent forwarding to keep reading your mail).
The Inbox Security Checklist
Unique strong password. App-based 2FA. Recovery options current. Backup codes saved. Third-party access audited. Phishing awareness on. Do these six and your master key is genuinely secure.
About the Author
