How to Protect Your Email Account

Email accounts are high-value targets because they sit at the centre of many account recovery, identity, communication, and payment workflows.

A compromised mailbox can support credential theft, account takeover, password reset abuse, business email compromise, invoice redirection, identity theft, data theft, social engineering, and contact-list phishing.

Email is often the recovery root.

Many services treat control of an email address as proof that a user can reset a password, approve an account change, receive a login link, retrieve a one-time code, or confirm ownership of another account.

This makes email similar to a root account for a person’s digital life. If the attacker controls the inbox, they may be able to discover which services the victim uses and then trigger recovery flows across those services.

Common compromise paths include:

• Password reuse after a breach.
• Credential stuffing against popular email providers.
• Phishing pages that copy email login screens.
• Malware or infostealers that capture credentials or session cookies.
• OAuth consent phishing that grants mailbox access without stealing the password.
• SIM swap or phone account compromise where SMS is used for recovery.
• Weak or outdated account recovery options.
• Compromised devices that already hold active sessions.
• Legacy protocols, app passwords, or mail clients with weaker controls.

Multi-factor authentication helps, but the type matters.

SMS codes are better than no second factor, but they can be affected by SIM swap, phone number takeover, message interception, or social engineering.

App-based codes are generally stronger than SMS, but users can still be tricked into reading a code to an attacker or entering it into a phishing site.

Push approvals can be convenient, but attackers may use repeated prompts or convincing stories to trick a user into approving a sign-in.

Security keys and passkeys can provide stronger phishing resistance because they are tied to the legitimate domain and are harder to reuse on a fake site.

Session security matters too.

Attackers do not always need the password if they can steal or reuse an authenticated session. Infostealer malware, malicious browser extensions, compromised devices, or phishing proxies may attempt to capture session cookies or tokens.

Changing the password is important after compromise, but it may not be enough if existing sessions, OAuth grants, app passwords, or connected devices remain active.

Mailbox rules are a common persistence and concealment technique.

An attacker may create forwarding rules, filters, labels, or deletion rules to hide security alerts, copy messages externally, watch for invoices, or monitor password reset emails.

After a suspected compromise, users should check:

• Forwarding addresses.
• Mail filters and rules.
• Delegated mailbox access.
• Connected apps and OAuth grants.
• App passwords.
• IMAP, POP, or SMTP access.
• Active sessions and trusted devices.
• Recovery email addresses and phone numbers.
• Recent security events.

Recovery settings are part of the attack surface.

A strong password and MFA can be weakened by old recovery email addresses, recycled phone numbers, easy security questions, exposed personal information, or weak support processes.

Account recovery should be reviewed as carefully as the primary login method.

Email compromise also increases scam credibility.

Messages sent from a real account can bypass suspicion because they appear in existing threads, use familiar tone, include real signatures, and may reference genuine previous conversations.

This is especially dangerous for payment redirection. An attacker who can read email may wait for an invoice, property settlement, supplier payment, or other high-value transaction, then insert altered bank details at the right moment.

For businesses and domain owners, email authentication matters.

SPF, DKIM, and DMARC help reduce spoofing of owned domains, but they do not stop every form of impersonation. Attackers can still use lookalike domains, compromised legitimate accounts, display-name impersonation, or personal email accounts.

DMARC alignment and enforcement can improve protection against direct domain spoofing, but users and processes still need to handle compromised accounts and lookalike sender domains.

Useful technical controls include:

• Unique passwords stored in a password manager.
• Phishing-resistant MFA where available.
• Security keys or passkeys for high-value accounts.
• Sign-in alerts and account activity reviews.
• Removal of unused connected apps and OAuth grants.
• Disabling legacy access methods where possible.
• Reviewing forwarding rules and mailbox filters.
• Keeping devices and browsers updated.
• Endpoint protection and browser security controls.
• Separate admin accounts for business email administration.
• Strong recovery settings and protected recovery accounts.
• User education around MFA codes, approval prompts, and fake login pages.

A useful security model is to separate four areas:

• Authentication: how someone signs in.
• Recovery: how someone gets back in.
• Access: which devices, apps, sessions, and integrations can read the mailbox.
• Impact: what other accounts, payments, documents, and people depend on the mailbox.

Protecting email well means protecting all four areas, not just choosing a stronger password.

If an email account may be compromised, the response should include password change, MFA review, session revocation, recovery review, connected-app review, mailbox-rule review, and checks on other accounts that rely on that email address.