Think about how many accounts are connected to your email address. Your bank sends password resets there. So do your work account, cloud storage, shopping accounts, and probably a few services you haven’t used in years. If someone gets access to that inbox, they may be able to get into several other accounts without knowing all your passwords.
This is why keeping personal and work accounts secure matters. The two aren’t as separate as they might seem.
If You’ve Clicked a Suspicious Link
Don’t assume that changing your password immediately is enough. First, consider whether the device itself might have been affected. If you downloaded a suspicious file or entered information on a fake page, stop using that device for account changes. Disconnect it from the internet if you suspect malware, and have it checked before using it to access sensitive accounts again.
Protecting your identity online is not complicated, but it is always better to secure things before it goes south. Moonlock has a guide about securing your accounts before itโs too late, explaining that the important thing is to deal with the device as well as the accounts. Changing passwords on a compromised device may expose the new ones too. Once you’re using a device you trust, start with your main email account. Then secure your bank accounts and work logins. If your employer uses a single sign-on system, contact the IT team as soon as possible. They may need to check access or take additional steps.
Don’t stop checking once the passwords have been changed. Over the following weeks, look through recent sign-ins and make sure the recovery email addresses and phone numbers are still yours. Check your email settings as well. Someone could have added a forwarding rule to receive copies of your messages, even after you’ve regained control of the account.
How One Account Can Lead to Another
One of the biggest problems is using the same password, or small variations of it, across different websites. If a shopping or streaming service gets breached, criminals can take the leaked login details and try them on email accounts, work platforms, and other services. They don’t have to guess every password individually.
Recovery settings can create another connection. For example, if you use your personal Gmail address to recover your work account, someone who takes over that Gmail account may have a way into your work account too.
The devices we use can blur the line even further. Many people use one phone for work verification codes, personal messages, shopping apps, and everything else. A freelancer might also have access to several clients’ shared folders from the same laptop. If that device is compromised, the problem may extend beyond the freelancer’s own information.
Shared accounts create a different issue. When several employees use the same login for a social media page or supplier portal, it becomes difficult to know who accessed it or when. If something goes wrong, there may be no clear way to trace what happened.
Phishing is often how these situations begin. A convincing email or message gets someone to open a link, enter their login details, or share a verification code.
Make Your Accounts Harder to Break Into
A strong password is useful, but it shouldn’t be the only added protection against online fraud. Turn on two-factor authentication, particularly for your email, banking, and work accounts.
An authenticator app is generally a better choice than receiving codes by text. Text messages can be intercepted through SIM-swapping scams, where criminals convince a mobile provider to transfer someone’s number to another SIM card. Passkeys offer another option. They are linked to the genuine website, which makes them much harder to use on a fake login page.
It’s also worth using a password manager. Remembering a different, strong password for every account isn’t realistic for most people. A password manager takes care of that and makes it easier to avoid reusing passwords.
Take a look at your recovery details while you’re at it. If possible, use a separate email address for account recovery rather than one that you use for shopping, newsletters, and everyday messages. Old accounts deserve attention too. If you no longer use a service, close the account rather than leaving old personal information and login details sitting there. Finally, enable sign-in notifications on important accounts so you know when someone accesses them.
Protecting Your Identity Beyond Passwords
Not every form of identity theft starts with someone logging into an account. In the United States, for example, you can place a credit freeze with each of the three major credit bureaus. It is free and makes it harder for someone to open new credit accounts in your name. You’ll need to lift the freeze temporarily when you apply for credit yourself.
Other digital identification solutions include biometric locks on phones, bank verification checks, and fraud alerts. They all make it harder for someone to use your information without permission.
Still, none of these measures can prevent every scam. If someone convinces you to hand over a verification code or approve a payment, the usual account protections may not help. Be suspicious of unexpected requests, especially when they create a sense of urgency. Instead of replying or calling the number in the message, contact the company using details you already know are genuine.
The problem is widespread. The Federal Trade Commission reported more than 1.1 million identity theft reports in 2024. People in the United States who discover that their identity has been misused can report it through IdentityTheft.gov, which also provides steps for dealing with the situation.
If you only have time to deal with a few accounts today, start with your main email address, then your bank, then your work accounts. Give each one its own password and enable an authenticator app or passkey. Those accounts are a good place to start because access to them can affect so much else.
Blog received on email.
