Email Security Habits That Stop Most Attacks

Email is often treated as just another app, but functionally it's closer to a master key. Password reset links, account verification codes, and financial statements all flow through it. Whoever controls your inbox can usually take over most of your other accounts in a matter of minutes.

Protect the account itself first

Before worrying about individual messages, make sure the account holding them is locked down: a unique, long password stored in a password manager, and multi-factor authentication using an authenticator app or hardware key rather than SMS where possible. This single step does more to protect your digital life than almost any other on this site.

Use a dedicated address for recovery

Where a service supports it, set a separate recovery email address that isn't your primary inbox. That way, a compromise of your day-to-day email doesn't automatically hand over the reset path for your bank or password manager as well.

Be skeptical of urgency, not just unfamiliar senders

Modern phishing frequently comes from addresses that look plausible or even from real, compromised contacts. Rather than relying on "do I recognize this sender," watch for the underlying pattern: unexpected urgency, a request to click a link or open an attachment, or a request that bypasses your organization's normal process (an unusual payment request, a sudden change in bank details).

Don't forward sensitive information carelessly

Email threads accumulate attachments and sensitive details over time — tax documents, ID scans, medical information. Before forwarding an old thread, check what's buried in it. Consider deleting genuinely sensitive attachments from your inbox once you no longer need them, rather than letting them sit indefinitely.

Watch your account activity

Most email providers show a recent login activity or active sessions page. Check it occasionally for unfamiliar locations or devices, and use the option to sign out of all other sessions if anything looks wrong, followed immediately by a password change.

Clean up old app access

Over years of use, email accounts accumulate a long list of third-party apps with standing access. Review this list periodically and revoke access for anything you no longer use — each one is a potential path into your inbox that has nothing to do with your password at all.

Treat your inbox less like a mailbox and more like the front door to everything else you own online. The handful of habits above are what keep that door properly locked.