🎯 In 30 seconds: Almost every “forgot password” link lands in your inbox, so whoever controls your email can reach your bank, brokerage and shopping accounts. Give the email account the strongest sign-in you have, check that the recovery phone and address are yours, and look for the quiet changes attackers make: forwarding, filters, delegates and connected apps.
Why the inbox matters more than any single bank login
Think of your accounts as rooms in a building. Each room has its own lock, but your email holds the spare key to nearly all of them. A thief who gets into the inbox doesn’t need to guess your bank password. They click “forgot password,” wait for the reset message, and change it.
There is a second, quieter danger. Someone with inbox access can read years of statements, tax documents and receipts. That is enough to answer security questions, impersonate you on the phone, or send a convincing invoice to your contacts. So the goal is twofold: keep people out, and notice fast if anyone gets in.
Step 1: give the email account your strongest sign-in
- A long, unique password. Never one you have used anywhere else. The Security section’s passwords and passkeys page explains passphrases and password managers.
- A passkey or security key if your provider offers one, then an authenticator app. A text-message code is the fallback, not the first choice, because a SIM swap redirects texts.
- Recovery codes saved twice: once in your password manager and once on paper somewhere safe at home. They get you back in if your phone is lost.
Step 2: the settings audit
Attackers who get in often change a setting so they keep access even after you change the password. Google’s own advice for a compromised account lists most of these. Outlook, Yahoo and Apple’s iCloud Mail have the same ideas under different menu names; search the settings page for each word below.
| Setting | What a thief does with it | What you should see |
|---|---|---|
| Recovery phone and email | Points account recovery at their own number or address. | Only a phone and address you own and can open today. |
| Forwarding | Sends a copy of every message to an outside address. | Off, or only to an address you set up yourself. |
| Filters or rules | Moves bank alerts and “new sign-in” warnings to trash or an obscure folder, so you never see them. | Only rules you remember making. |
| Delegates or shared access | Grants another account the right to read and send as you. | Nobody, unless you added a spouse or assistant on purpose. |
| Connected apps | Keeps reading mail through an app that has its own access, even after a password change. | Only apps you use. Remove the rest. |
| Signed-in devices and recent activity | Stays signed in on their laptop. | Only your devices. Sign out anything unfamiliar. |
| Auto-reply, signature, display name | Adds a payment link or changes your name for an impersonation. | Text you wrote yourself. |
Step 3: map what the inbox unlocks
You can’t protect accounts you have forgotten. Search your mailbox for phrases such as “welcome to,” “verify your email,” “confirm your account” and “your statement is ready.” Note each company, then sort the list into three tiers.
| Tier 1: money | Banks, cards, brokerages, retirement plans, payment apps, tax and Social Security logins. Strongest sign-in, reviewed first. |
| Tier 2: identity | Phone carrier, Apple, Google or Microsoft account, password manager, health portals. |
| Tier 3: everything else | Shops, streaming, newsletters, old forums. Close the ones you no longer use. |
A worked example: Priya’s one-hour audit
Priya, 38, has one personal email address she has used since college. Her search turns up 71 companies. She sorts them: 9 in Tier 1, 6 in Tier 2 and 56 in Tier 3.
- Minutes 0 to 15: she adds a passkey to the email account, keeps the authenticator app as backup, and saves 10 recovery codes in her password manager and on paper.
- Minutes 15 to 30: the settings audit. She finds an old forwarding address from a job that ended in 2019 and a shopping app with mail access she never uses. Both go.
- Minutes 30 to 60: she checks the 9 money accounts. Two still use a password she shared with an old streaming login. She changes both.
Of the 56 Tier 3 accounts, she decides to close 20 over the next month, about 5 a week. Every closed account is one fewer company that could leak her address and password. That leaves 51 active accounts instead of 71, a 28% cut in the number of places her details live.
Habits that keep it locked
- Read security notices instead of deleting them. A “new sign-in” email you didn’t expect is the earliest warning you will get.
- Repeat the settings audit twice a year, for example when the clocks change.
- Keep the recovery phone current. If you change numbers, update every Tier 1 and Tier 2 account the same day.
- Don’t sign in to email on shared or library computers. If you must, sign out and close the browser.
- Some people use a separate address only for money accounts, one they never give to shops or newsletters. It gets less spam and fewer phishing attempts, and a leak at a store doesn’t reveal it.
If the inbox is already in someone else’s hands, go straight to the first-hour plan on the Money Theft & Forensics page and this section’s page on what to do when you are hacked.
- Why does a thief want your email more than one bank password? Answer: Password resets for most other accounts land in the inbox.
- Name two settings an attacker changes to keep access. Answer: Any two of forwarding, filters, delegates, connected apps, recovery phone or email.
- You stopped getting your bank’s alerts. What do you check first? Answer: Your filters or rules, then forwarding.
- Where should recovery codes live? Answer: In your password manager and on paper in a safe place, not only on your phone.