Email Account Security

Your email is the master key to your online life. Password reset links for your bank, payroll, social media and shopping accounts all go there. If a criminal gets into your email, they can take over almost everything else, or quietly watch for invoices and payment details to steal.

• Everyone
• Small Business

Lock it down

• Use a long, unique password you don’t use anywhere else. See Strong Passwords.
• Turn on two-factor authentication. An authenticator app, security key or passkey is stronger than a text message code. See Two-Factor Authentication.
• Keep your recovery phone number and backup email up to date, so you can get back in if you’re locked out.
• Save your backup codes somewhere safe, such as a password manager.

Check these settings a few times a year

• Forwarding: no addresses you don’t recognize are getting copies of your mail
• Filters and rules: no rules that delete, hide or move messages (hackers use these to hide bank alerts)
• Recent activity: no sign-ins from unknown devices or places
• Connected apps: remove apps and services you no longer use
• Recovery info: phone and backup email are still yours

Watch what lands in your inbox

• Fake “your mailbox is full” or “verify your account” messages try to steal your password. Go to your email provider directly instead of clicking. See Phishing Emails.
• Don’t open unexpected attachments, even from people you know. Their account may be hacked.
• For businesses: always confirm changes to payment or bank details by phone, using a number you already have. See Invoice Fraud.

Signs your email was hacked

• Friends get messages or spam you didn’t send
• Password reset emails you didn’t request
• Missing messages, or messages already marked as read
• Security alerts about new sign-ins
• You can’t sign in

If it’s been hacked

1. From a device you trust, change your password, or use your provider’s account recovery if you’re locked out.
2. Sign out of all sessions and turn on two-factor authentication.
3. Remove unknown forwarding addresses, filters and connected apps.
4. Change passwords on accounts that use the same password, starting with banking and payroll.
5. Warn your contacts not to open messages that came from you.
6. Scan your computer for malware. See If Your Account Is Hacked.

Work email

Follow your employer’s rules, report suspicious messages to IT right away, and never forward work email to a personal account unless you’re allowed to.

Last updated: October 2, 2026