Resource note
Resources / Account Security
Many online services use email for sign-in alerts or account recovery. If that inbox is taken over, the accounts that rely on it may be at risk as well.
Work through this checklist:
- Review recovery phone numbers and alternate email addresses; remove ones you no longer control.
- Use a unique password stored in a password manager.
- Turn on the strongest sign-in method the provider supports, preferably a phishing-resistant security key or passkey where available.
- Store backup codes somewhere separate from the account and device they recover.
- Review signed-in devices, app access, forwarding rules, and recovery notifications.
Then identify which important accounts send password-reset links to this inbox and review their recovery methods. Do not remove a recovery option until you have confirmed a working replacement. A compromised inbox can affect other accounts, but the exact exposure depends on each provider's reset and authentication settings.