← Back to BlogIllustration of a secured email envelope with lock, key and shield icons

Make This Account More Secure Than Everything Else

2026-10-21

If you only secure one account properly this year, make it your email. It is the master key to almost everything else you own online.

Think about what happens when you click “Forgot password” on your bank, social media, cloud storage or shopping sites. The reset link goes to your email. Whoever controls your inbox can reset those passwords, read the confirmation codes and quietly delete the “your password was changed” notices before you ever see them.

Why email comes first

More than just messages

Your inbox also holds years of sensitive history: invoices, contracts, tax documents, photos of IDs and conversations about money. For a business, a compromised mailbox is even more dangerous. It is the starting point for fake payment requests that appear to come from the boss, fake invoices sent to real customers and phishing emails that colleagues trust because they come from a real coworker’s address.

Protect the account that can reset all the others.

The lockdown checklist

  • Use a long, unique password: Never reused anywhere else. A password manager makes this painless.
  • Turn on multifactor authentication: Prefer an authenticator app, passkey or security key over text messages.
  • Review recovery options: Make sure the recovery phone number and backup email are current and belong to you. Remove old numbers.
  • Check signed-in devices: Your account settings list every phone, computer and app with access. Sign out anything you do not recognize.
  • Look for forwarding rules and filters: Attackers love rules that silently forward copies of your mail or move certain messages to trash.
  • Review connected apps: Remove third-party apps and add-ons that no longer need access to your mailbox.

Not all MFA is equal

Any second factor is far better than none, but some are much harder to defeat. Text-message codes can be stolen through SIM-swap attacks, and both text codes and app codes can be phished by a convincing fake login page that asks you to type them in. CISA’s guidance on multifactor authentication is blunt about it: the only widely available phishing-resistant option is FIDO authentication, which is what passkeys and hardware security keys use.

  • Good: Text-message codes. Better than a password alone.
  • Better: An authenticator app with number matching, where you type the number shown on screen into your phone.
  • Best: A passkey or hardware security key. It only works on the real site, so a phishing page gets nothing.

Gmail, Outlook.com, Microsoft 365 and Google Workspace all support passkeys or security keys today. For your most important account, it is worth the few minutes it takes to set up.

A realistic scenario

The rule you did not create

Picture a small business owner who types her Microsoft 365 password into a convincing fake “shared document” page. Nothing seems to happen. Two weeks later, a client calls to ask why the company’s bank details changed on its latest invoice.

Behind the scenes, the attacker signed in, created an inbox rule that moved any message containing the words “invoice,” “payment” or “wire” into an obscure folder, and then replied to real client threads from her real account. A five-minute monthly check of forwarding rules and signed-in devices would have caught it, and a passkey would have stopped the login in the first place.

Businesses using Microsoft 365 or Google Workspace: enforce MFA for every user, block legacy sign-in methods that bypass MFA, and turn on alerts for suspicious sign-ins and new forwarding rules. These settings stop the majority of mailbox takeovers.

For businesses running Microsoft 365 or Google Workspace

  • Require MFA for every user, including the owner and any shared or service accounts.
  • Block legacy sign-in methods that bypass MFA, such as old email protocols.
  • Block or alert on external forwarding, a classic sign of a compromised mailbox.
  • Turn on sign-in alerts for unusual locations and impossible travel.
  • Protect admin accounts separately: Use dedicated admin logins with the strongest MFA, never used for everyday email.
  • Have a plan for what to do the moment an account looks compromised; an incident response plan covers exactly this.

A ten-minute monthly checkup

Security settings drift. Old phones stay signed in, recovery numbers go stale, and apps you tried once keep access for years. Put a recurring reminder on your calendar and spend ten minutes on these questions:

  • Devices: Do I recognize every phone, computer and browser signed in to this account?
  • Activity: Are there sign-ins from places or times that were not me?
  • Rules: Are there any forwarding addresses, filters or inbox rules I did not create?
  • Recovery: Are my recovery phone and backup email still correct?
  • Apps: Does every connected app still need access?

It is the digital equivalent of checking that the doors are locked before bed. Most of the time everything is fine. The one time it is not, you will have caught it weeks earlier than you would have otherwise.

If you think your email was hacked

Change the password from a device you trust, sign out all other sessions, confirm MFA and recovery settings are yours, and delete any forwarding rules or filters you did not create. Then warn your contacts not to act on recent unusual messages from you, and check your bank, cloud storage and other accounts that use that email address. For a business account, call your IT provider right away. Speed matters.