Why an email address can be more than an inbox
Fictional example: Luca uses one email address for shopping, photo storage and several social accounts. When he forgets a shop password, its reset link arrives in that inbox. He realises that protecting this access first strengthens an important connecting point in his digital life. It does not replace securing the other accounts individually. It does help him prioritise limited time according to importance instead of changing an infrequently used account at random.
Make a small overview without secrets
On a protected note, record only the names of important services and which email address each uses. Mark whether that address merely receives messages or also supports account recovery. If you sign in through a central identity provider, that provider’s whole account may be significant. Do not add passwords, codes or security answers. The note is meant to show dependencies, not store access secrets. It should not become a publicly shared family document.
Review sign-in protection directly with the provider
Open the service through your known app or address and find security settings. Since 2026, the UK NCSC recommends passkeys where the service supports them and additional verification where it does not. If a password remains as a sign-in or fallback option, keep it strong and unique. Follow your provider’s actual instructions and change one step at a time. A password manager can help create and store different passwords, provided its own access is protected.
Include recovery and your own devices in the plan
Check that recovery phone numbers and addresses still belong to you and remain accessible. Avoid a plan where recovering access requires the very same sole account you have just lost. Use the provider’s supported alternatives and protect any recovery codes it supplies. Also review signed-in devices and connected applications. An unfamiliar location name is not automatically an attack because network routing can affect it; nevertheless, investigate an unrecognised sign-in using the official guidance.
If takeover is suspected, move beyond routine tidying
Messages sent without you, changed recovery details or being locked out make this more than an ordinary housekeeping task. Use the provider’s official account-recovery or security instructions. After regaining access, check unexpected forwarding addresses and mail rules where available. If payment services are affected, contact their support too. Work accounts are subject to your organisation’s rules: report suspicious activity to the responsible IT team rather than trying to bypass its security measures yourself.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Do I need to create a new email address for this?
Not necessarily. Often it is more useful to protect the existing important account properly and understand its recovery options. Another address creates more administration. Decide whether it serves a concrete purpose before opening one simply for reassurance.
Does securing email protect every other service automatically?
No. Other accounts still need their own secure sign-in methods and appropriate recovery options. Email is a useful first priority because many services depend on it, but it is not universal protection for every application or every possible incident.
Does an unfamiliar location in the device list prove an attack?
Not by itself. Location estimates can be inaccurate because of the network connection, for example. Compare the device, time and your own activity. If you cannot identify a session, use the account’s official security controls and review recovery details and other suspicious changes.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- NCSC: Protect your email accountSource review date:
- NCSC: Passkeys guidance, April 2026Source review date:
- BACS: Konto gehackt oder Daten abgeflossenSource review date:
