3 Moves Lock Criminals Out of Your Email for Good

One email breach gave criminals access to Lisa's PayPal, Amazon, and nearly her bank account in just 40 minutes, and they never touched a single password.

Here's the scary truth: your email holds the keys to everything. Bank statements, medical records, retirement accounts, and every password reset link for every account you've ever created all flow through one inbox. Criminals don't need to hack your bank when they can hack the front door to all of it.

The attack happens faster than ordering takeout. A criminal clicks "forgot password" on your bank's website, enters your email address, and waits for the reset link to arrive in your compromised inbox. They click it, create a new password, and walk right into your account. Then they repeat the process with Amazon, PayPal, your brokerage, and your health insurance portal. Each takeover takes about 60 seconds.

This account takeover fraud cost Americans $2.7 billion last year alone. The FBI reports that 81% of victims thought they were "pretty careful" about security before it happened to them.

The fix takes 20 minutes and three simple moves. First, create a password for your email that's at least 16 characters long and completely unique. Password managers like NordPass generate random passwords you'll never have to remember and store them securely for less than two dollars a month.

Second, enable two-factor authentication, but skip the text message codes. Criminals can hijack SMS codes through SIM swap attacks, where they convince your cell carrier to transfer your phone number to their device. Google Authenticator generates codes directly on your physical phone instead, making them impossible to intercept remotely.

Third, audit every app connected to your inbox. Every time you clicked "Sign in with Google," you gave that app access to your email. Some can read your messages and send emails pretending to be you. One security expert found 34 forgotten apps still holding master keys to their Gmail account. Visit your Google account security settings and revoke access to anything you don't actively use.

The Bright Side

Unlike credit cards with zero-liability protection or banks with fraud departments, your email security lives entirely in your hands. That means you have complete control to protect it. These three steps work because they address the exact methods criminals use most often: weak passwords, intercepted codes, and forgotten access points.

Lisa spent a panicked Tuesday night cleaning up the damage and wishes she'd invested 20 minutes on a boring Sunday afternoon instead.

Your inbox is either a fortress or an open door, and 20 minutes today determines which one it becomes.