Email Security: Protect Your Most-Targeted Account

Why Your Email Account Is the Most Important Account You Own

Your email address is linked to virtually every other online account you have. Reset your bank password? It goes to your email. Recover your social media account? Email. Unlock your cloud storage? Email.

This means whoever controls your email controls everything else. A criminal who gains access to your inbox can reset the password on every account linked to that address, locking you out while they take over your digital identity.

Yet most people treat their email account with the same level of security as their pizza delivery account. That needs to change.

Use a Strong, Unique Password

Your email password must be:

• At least 16 characters long — longer is better
• Unique — not used on any other site, ever
• Randomly generated — not based on words, names, or dates

Use a password manager to generate and store it. If you can remember your email password, it's probably not strong enough.

Never type your email password into any site or prompt that doesn't start with your email provider's official URL. Phishing pages are designed to look identical to Gmail, Outlook, or Yahoo login pages.

Enable Two-Factor Authentication — Right Now

Two-factor authentication (2FA) is non-negotiable for email. Even if someone steals your password, they cannot access your account without the second factor.

Set it up today:

1. Go to your email provider's security settings
2. Look for "Two-Step Verification" or "Two-Factor Authentication"
3. Enable it and choose your second factor method

Authenticator apps (Google Authenticator, Authy, or built into most password managers) are far more secure than SMS codes. SMS 2FA can be defeated by SIM swapping — a social engineering attack where a criminal convinces your carrier to transfer your phone number to their SIM card.

If your provider supports hardware security keys (like a YubiKey), this is the strongest option available and completely immune to phishing.

Recognize Email-Based Attacks

Email is the #1 delivery mechanism for cyberattacks. The most common threats:

Phishing: Emails that impersonate trusted organizations (banks, Google, Amazon, your employer) to trick you into clicking malicious links or entering credentials. Warning signs include urgent language, slightly wrong sender addresses, and links that go to unexpected domains.

Spear phishing: Personalized attacks that use your name, job title, or other details to seem legitimate. These are harder to spot.

Malicious attachments: PDFs, Word documents, and ZIP files that install malware when opened. Treat unexpected attachments with suspicion even from known contacts — their account may be compromised.

Business Email Compromise (BEC): Attackers impersonate executives or vendors to trick employees into transferring money or sharing sensitive data.

The rule: when in doubt, don't click. If an email asks you to do something urgent, verify through a separate channel — call the person or navigate to the website directly.

Review Account Recovery Options

Attackers who can't brute-force your password often target account recovery instead. Review your recovery settings:

• Recovery email address — Is this also secured with a strong password and 2FA?
• Recovery phone number — Vulnerable to SIM swapping. Consider removing if you have other recovery options.
• Security questions — If your provider still uses these, set nonsensical answers stored in your password manager. Your mother's maiden name is googleable; "Xk9!purple#train" is not.
• Trusted devices — Review and remove any devices you no longer own or recognize

Be Careful About What You Store in Email

Your inbox is often an accidental treasure trove of sensitive information:

• Password reset emails that contain temporary credentials
• Scanned copies of identity documents
• Financial statements and tax documents
• Legal contracts and confidential business information

Practice inbox hygiene: delete emails containing sensitive credentials after you've used them. Move important documents to encrypted storage rather than leaving them searchable in your inbox. An attacker who gains access to your email will search it thoroughly.

Monitor Your Account for Unauthorized Access

Both Gmail and Outlook show you recent login activity. Check it:

• Gmail: Scroll to the bottom of your inbox and click "Details" to see recent access
• Outlook: Go to Account > Security > My sign-in activity

Look for logins from unfamiliar locations or devices. If you see anything suspicious, change your password immediately and terminate all other sessions.

Enable notifications for new logins from unrecognized devices — most major providers offer this as a security alert option.

Consider a Privacy-Focused Email Provider

For maximum privacy, consider switching from Gmail or Outlook to a provider that offers stronger protections:

• ProtonMail (proton.me) — Swiss-based, zero-knowledge encryption for stored emails, open source
• Tutanota — German-based, end-to-end encrypted email and calendar
• Fastmail — Australian-based, strong privacy policies (not E2EE but reputable)

Note that end-to-end encrypted email only protects messages when both sender and recipient use the same provider or exchange PGP keys — most email is still delivered via standard SMTP between providers.

Keep Your Email App and Browser Updated

Vulnerabilities in email clients and browsers can be exploited to execute malicious content from specially crafted emails. Keep all software updated and enable auto-updates where possible.

Avoid reading email in very old browsers or mobile apps that haven't been updated — security patches are released regularly for good reason.

Your email account is the master key to your digital life. Treat its security accordingly: a strong unique password, authenticator app 2FA, and regular review of access logs will protect you against the vast majority of threats.