Email connects us to almost everything online. It's where we receive password resets, account alerts, documents, purchases, financial information, and personal conversations. That makes protecting your email one of the most important steps you can take to protect yourself online.
A few good habits can make it much harder for someone to gain access, impersonate you, or use your inbox against you. Check out the resources below for simple ways to better protect your email, recognize suspicious activity, and know what to do if something doesn't look right.
Protect your account
Use a unique password.
Your email password shouldn't be used anywhere else. If another website is compromised, a reused password could give someone access to your email and potentially other accounts.
Turn on 2FA.
Two-factor authentication adds another barrier if your password is stolen. Never approve an authentication request you didn't initiate.
Think before you click
Phishing messages are designed to look convincing. They may appear to come from a company you recognize, a coworker, friend, family member, or even a real account that has been compromised.
Before acting:
- Check the sender: Look beyond the display name and review the actual email address and domain.
- Check the request: Ask yourself whether you were expecting it and whether the request makes sense.
- Check the destination: Hover over links when possible. If you're unsure, open your browser and go directly to the company's website instead.
- Don't trust a message just because it came through a familiar service: Attackers can abuse legitimate services like DocuSign to deliver fraudulent requests, links, or files.
- Verify unusual requests another way: If something feels wrong, contact the person or company using contact information you already trust, not information provided in the suspicious email.
- Be careful with unexpected attachments: If you weren't expecting a document, invoice, shared file, or attachment, verify it before opening or downloading it.
Learn More: Recognize Phishing and Suspicious Emails
Manage Your Inbox Safely
Your email provider uses spam filters to help separate legitimate messages from unwanted or suspicious email. Those filters aren’t perfect, so a few simple habits can help improve your inbox experience.
- Check your Spam or Junk folder occasionally. Legitimate messages can sometimes be filtered by mistake, especially when they come from a new sender or organization.
- Mark legitimate messages as “Not Spam” or “Not Junk.” If a trusted message lands in Spam or Junk, use your email provider’s option to move it back to your inbox rather than simply moving or forwarding it. This can help your provider better recognize similar messages.
- Save trusted senders to your contacts. Adding people and organizations you regularly communicate with can make them easier to recognize and manage.
- Use “Report Spam” for unwanted messages. Rather than just deleting spam, reporting it helps your email provider identify similar unwanted messages.
- Use “Report Phishing” when available. Phishing is different from ordinary spam. If a message is trying to steal information, get you to sign in, send money, or take another suspicious action, report it as phishing when your provider offers that option.
- Be thoughtful about marking something as safe. A message landing in Spam or Junk doesn’t automatically mean it is dangerous, but don’t move it to your inbox simply because you recognize the name. Check the actual sender address and message first.
- Unsubscribe carefully. For newsletters or companies you recognize, use the unsubscribe option. For obviously suspicious or unfamiliar spam, reporting or deleting the message is often safer than interacting with links inside it.
Remember: A Real Email Address Can Still Send a Bad Email
A familiar sender doesn't automatically mean a message is safe.
If someone's email account is compromised, messages may actually come from their real address. Someone with access to the account may also be able to see previous conversations, making new messages feel even more convincing.
If someone you know suddenly asks you to send money, change payment information, share a verification code, open an unexpected document, or do something unusual, verify the request using a contact method you already trust.
Something doesn't look right?
Unexpected password resets, unfamiliar 2FA prompts, messages you didn't send, emails being moved or deleted unexpectedly, unfamiliar forwarding rules, or unknown devices may indicate someone else has accessed your account.