A demand to act immediately
An account closure, missed delivery or urgent payment request is designed to rush you. Pause before responding. Open the service through the app or address you normally use.
Protect your email. Keep control of your inbox.
A safer inbox starts with a few decisions you can repeat every day. Economic Competence Email Protection explains how to recognize suspicious messages, reduce unwanted mail and strengthen the account behind your inbox. Practical guidance for households and small teams in the United States.
Five warning signs worth a second look
A request for private information
Treat requests for a password, sign-in code, Social Security number or banking details as a reason to stop. A message is not proof that the sender is entitled to this information.
An unexpected file or QR code
Invoices, shared documents and QR codes can redirect you to a fake sign-in page or deliver unwanted software. Verify the request through a separate, familiar channel.
A familiar name with an unfamiliar address
Display names can be copied. Review the sender and reply address, then check the actual destination of a link. A professional design or correct spelling does not establish trust.
A payment method that feels unusual
Gift cards, cryptocurrency and a last-minute change to bank details deserve independent verification. Contact the person using an established phone number before sending money.
Build a stronger inbox routine
Spam filters help, but account settings and your own verification habits matter too. Start with these five practical checks.
Use a different password for your email
Choose a long, unique password and keep it in a reputable password manager. Reusing the same password means a breach elsewhere can also expose your inbox.
Add stronger sign-in protection
Enable multifactor authentication. Where your provider supports them, passkeys or security keys can help resist phishing. Never approve an unexpected sign-in prompt.
Keep recovery options up to date
Check that your recovery methods still belong to you. Save recovery codes somewhere secure and separate from the account they unlock.
Report unwanted mail carefully
Use your provider’s junk or phishing reporting controls. For a newsletter you recognize, use the provider’s unsubscribe feature. For suspicious messages, avoid links inside the message.
Review access and software updates
Remove app access you no longer need, check for unfamiliar forwarding rules and install updates for your mail app, browser and devices.
A suspicious message? Take a clear next step.
Do not reply, open the attachment or use a phone number supplied in the message. Visit the organization through a trusted app or type its known address yourself. If this is a work account, use your organization’s reporting process. After reporting the message, delete it. If you already shared a password, change it through the genuine service and review active sessions, recovery settings and forwarding rules.
Keep the routine simple
A few consistent habits are easier to maintain than a long list of rules. Use this short checklist whenever a message asks you to take action.
Pause
Give yourself time to examine the request. An urgent tone is a reason to slow down, not a reason to skip verification.
Verify
Check through a channel you already trust. A new message should not decide where you sign in or whom you call.
Report
Use your mail provider or workplace reporting tools. If money or identity information was exposed, contact the relevant institution promptly.
Questions about email protection
Can a spam filter stop every malicious message?
No. Filtering can reduce unwanted mail, but a carefully targeted message may still arrive. Combine filtering with strong account protection and independent verification.
Does a padlock prove that a website is legitimate?
No. An encrypted connection protects information in transit; it does not prove that the site belongs to the organization named in a message.
Is opening a message the same as opening an attachment?
These actions carry different risks. Keep your mail software updated, avoid loading unexpected external content and do not open files or follow links you have not verified.
What should I check after an account takeover?
Follow the provider’s recovery process. Reset the password, revoke unfamiliar sessions and connected apps, and inspect recovery details and forwarding rules. Let affected contacts or your workplace know through a trusted channel.
Where can U.S. readers report fraud or identity theft?
Use the mail provider’s phishing report option first. The Federal Trade Commission provides fraud reporting through ReportFraud.ftc.gov and identity theft recovery guidance through IdentityTheft.gov. Contact your financial institution promptly if payment information was exposed.