Think about your bank account. You probably treat its password like it matters — unique, long, maybe stored in a password manager. Now think about your email password. Be honest: is it as strong as the bank’s? For most people, the answer is no. And that’s backwards, because the email account is the one that actually unlocks everything else.
Here’s why. Forget your password on almost any site — shopping, social media, streaming, cloud storage — and what happens? The site emails you a reset link. Whoever controls your inbox can reset your password everywhere. Your bank usually adds extra checks like a phone call or an ID document, but most of the rest of the internet hands the keys straight to your email.
Attackers know this. When someone’s accounts get “hacked,” the story very often starts with their email. So before you harden anything else, harden this one account. It’s about fifteen minutes of work, and it protects every password reset you’ll ever receive.
Why your inbox is worth more than your bank login
The pattern repeats in support forums every day. Someone loses access to their Instagram, their Amazon orders, their cloud photos. When they describe what happened, the common thread is almost always the same: first the email went, then everything else followed. A compromised inbox doesn’t just expose your messages — it becomes a machine for taking over accounts, one “forgot password” click at a time.
There’s a second problem. Your inbox is also an archive. Old flight bookings, tax documents, scanned IDs, subscription receipts, password reset history from years of sign-ups — it sits there quietly, searchable, in one place. A bank account holds your money. Your email holds a map of your entire digital life, plus the tools to impersonate you in it.
How email takeovers actually happen
It usually isn’t some cinematic hack. The common routes are embarrassingly ordinary:
Reused passwords. This is the big one. You use the same password for your email and a dozen other sites. One of those sites gets breached, the stolen email-and-password pairs circulate, and automated tools try them against Gmail and Outlook. If the password matches, they’re in. The email provider did nothing wrong — you handed them the key.
Phishing sign-in pages. An email that looks like it’s from Google or Microsoft warns you about “suspicious activity” and links to a sign-in page that looks perfect but isn’t. You type your password; it goes straight to the attacker. The giveaway is always the same: the link doesn’t actually go to google.com or microsoft.com. But in a hurry, on a phone, plenty of people don’t look.
Stale recovery details. Your recovery phone is a number you gave up three years ago. Your recovery email is an account you no longer open. When you actually need to prove you’re the owner, the safety net isn’t there — and sometimes, worse, an attacker who’s already poking around can add their own.
None of these require you to be careless in any dramatic sense. They require exactly the kind of ordinary inattention most of us give our oldest account.
The warning signs most people miss
Email takeovers rarely announce themselves with a big red alert. More often the clues are small, and they’re easy to explain away:
- A “password changed” or “new sign-in” email from Google, Microsoft, or Apple that you didn’t trigger. Don’t click the link inside it — go to the account’s security page directly and look.
- Login alerts mentioning places or devices you don’t recognize.
- Friends telling you they got strange messages from you, or your sent folder showing emails you never wrote.
- Filters or forwarding rules you didn’t create — attackers sometimes set up a rule that quietly forwards your mail to them, so even resetting your password doesn’t fully cut them off.
- Your recovery email or phone number suddenly being different from what you set.
If any of these look familiar, don’t wait. Go through the lockdown below and then check for that forwarding rule specifically — in Gmail it’s under Settings → See all settings → Forwarding; in Outlook it’s under Settings → Mail → Forwarding.
The 15-minute lockdown
Do these in order. Most of it is in Google’s and Microsoft’s own account pages, and you only need to do it once.
1. Give it a password that exists nowhere else. This matters more than anything else on this list. A long, random, unique password, stored in a password manager. If you’ve been reusing your email password anywhere — and most people have — this single change closes the largest hole.
2. Turn on two-step verification. In Google, go to your Google Account → Security → 2-Step Verification; in Microsoft, go to account.microsoft.com → Security → Advanced security options. Pick an authenticator app or a passkey/security key rather than text-message codes if you’re offered the choice — Google now lets you set up two-step verification without a phone number at all, and SMS codes are the weakest option because phone numbers can be hijacked. Whatever you choose, texted codes still beat no second factor at all.
3. Check your recovery email and phone number right now. In Google, they’re under Security → “How you sign in to Google” → Recovery email and Recovery phone. In Microsoft, they’re under Security → Security info. Three things to verify: the recovery email is one you actually still open, the phone number is one you actually still carry, and neither belongs to someone else. Google specifically advises using a different email address from the one you sign in with, and not using a Google Voice number as your recovery phone, since you couldn’t receive a recovery code on it if you were locked out.
4. Look at your recent sign-in activity. Google’s security page shows recent sign-ins and your devices; Microsoft shows sign-in activity too. Skim for anything you don’t recognize. If something looks wrong, change the password and sign out of all sessions before doing anything else.
5. Save your backup codes. Google lets you generate a set of one-time backup codes (each works once) for getting in when your phone is lost or your authenticator app is unavailable. Store them somewhere safe — printed on paper in a drawer works fine. This is the step everyone skips and the one everyone wishes they hadn’t.
6. Remove old access. While you’re in the security pages, glance at connected apps and signed-in devices. Revoke anything you don’t recognize or no longer use. It takes thirty seconds.
Two habits that keep it that way
The lockdown gets you safe. These two habits keep you safe.
First, treat every “sign in to verify” email as guilty until proven innocent. Never click the link. If an email claims there’s a problem with your account, open your browser, type the provider’s address yourself, and check from there. The five extra seconds it costs is the entire difference between you and most phishing victims.
Second, update your recovery details the week you change your phone number — not a year later. That number sitting in your security settings is only useful while it’s yours. Set a reminder on the day you get a new SIM. It’s a two-minute job and it’s the safety net everything else depends on.
If you’re already locked out, here’s the honest truth
Recovery is possible, but it’s deliberately slow and sometimes impossible — that’s the point of the security. Google’s recovery is fully automated; there’s no live support line that can unlock your account for you, and the process starts at the account recovery page where you verify your identity. If you never set a recovery email or phone, proving the account is yours becomes extremely difficult.
Microsoft works similarly: there’s an account recovery form, and if you’ve lost access to all your security information, replacing it can involve a waiting period of around 30 days while Microsoft gives the real owner a chance to object. Support agents can’t skip it.
The uncomfortable takeaway: the time to set recovery options is before you need them. If you’re reading this section because you’re locked out right now, start the official recovery process immediately — and once you’re back in, do the lockdown above so you never have to do it again.
Your email account is the one credential your entire digital life quietly depends on. Treat it like the master key it is — unique password, second factor, current recovery details, backup codes somewhere safe. Fifteen minutes, once, and the most valuable account you own is finally guarded like it.
Want more practical guides like this? Browse the Online Safety section for more.
Comments 8