Your email address is probably already out there.
The free breach-lookup site Have I Been Pwned has recorded more than 17.8 billion email accounts exposed in data breaches. You can’t take an address back once it leaks. But you can make it much harder to use against you.
That matters because your email is the key to almost every other account you have. When you forget a password for your bank, a store or your doctor’s office, the reset link goes to your email. Anyone who gets into your email can often get into everything else.
October is Cybersecurity Awareness Month, and this year’s theme from the National Cybersecurity Alliance is “Don’t Make It Easy for Them.” Here are 10 steps in three parts: keep your email secure, keep it simple, and keep it private. Steps 1 to 9 are free and work with any email: Gmail, Outlook, Yahoo, iCloud or anything else. Most take a few minutes. Tick each box as you go.
Secure: make your account hard to break into
Go to HaveIBeenPwned.com and type in your email address. It’s free. If it lists any sites, change your password on each one, starting with any site where you used the same password as your email.
When you sign up for a website or a phone app, never use the password that protects your email. If that site is breached, scammers try the same email and password everywhere, starting with your inbox. A password manager makes a different password for every account and remembers them for you.
Two-step sign-in asks for a second check, like a code on your phone, when someone signs in. Then a stolen password alone isn’t enough to get into your account. Look for it under “Security” in your email settings. If your provider offers a passkey, turn that on too.
Updates fix the security flaws scammers look for. Turn on automatic updates so you don’t have to remember.
Scam emails try to rush you: your account is locked, your package is held, your benefits will stop. Before you do anything:
- Look at the sender’s real email address, not just the name.
- Don’t click links or open attachments you weren’t expecting.
- Go to the company’s own website or app instead, or call the number on your card or bill.
- Report fake emails at ReportFraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org.
Simple: a calmer inbox is a safer inbox
Unsubscribe links in spam can tell scammers your address is real and someone reads it, which can bring even more scam mail. Only unsubscribe from companies you know and signed up with. For everything else, mark it as spam and delete it.
An overflowing inbox is where mistakes happen: you’re rushing, and you click the wrong email, link or file. Archive everything you’ve already dealt with, delete what you don’t need, and keep your inbox for what still needs you.
Private: keep your email your business
Every store, contest and coupon site you give your email to can lose it in a breach, sell it, or fill your inbox. Many people end up juggling a second address, throwaway aliases or extra accounts just to keep their main inbox usable. That’s more passwords and more places to check.
Free email is paid for somehow. Read your provider’s privacy policy and check your settings. For example, Gmail’s “smart features,” which use AI on the content of your email, are switched on by default; you can turn them off in Gmail’s settings (TechSpot).
Fight back
Once your address has leaked, there’s no one to ask to stop using it. Nobody on the dark web takes requests. What you can control is who gets in.
Scammers aim hardest at older adults. In 2025, Americans age 60 and over reported $7.7 billion in losses to the FBI, more than any other age group. Sit down with a parent or grandparent this week and go through this list together. It takes about half an hour, and it may be the most useful thing you do for them this year.
Want email where only people you approve can reach your inbox, and everyone else goes to Trash?
Create Your AccountYour Inbox. Your Rules.
Questions people ask
How do I know if my email was in a data breach?
Type your email address into HaveIBeenPwned.com, a free site that tracks data breaches. It lists every breach your address appears in, so you know which passwords to change.
How do I stop scam emails?
Spam filters catch a lot, but not everything, so check the sender’s real address and don’t click surprise links. To stop strangers from reaching your inbox at all, use opt-in email: OptMsg is a private, opt-in email service where only people you approve can reach your inbox. Everyone else goes to Trash.
What is a passkey?
A passkey is a way to sign in without a password. It uses your face, fingerprint or phone PIN instead, so there is no password for a scammer to steal or guess.
What should I do if I clicked a link in a scam email?
Don’t panic. Change your email password from a different device, turn on two-step sign-in, and watch your bank and card statements. If you entered money or account details, call your bank right away and report it at ReportFraud.ftc.gov and to the FBI at ic3.gov.
What email is best for older parents?
Look for email that keeps strangers out of the inbox and has no password to steal. OptMsg does both: only people you approve can reach the inbox, everyone else goes to Trash, and accounts sign in with a passkey instead of a password.
Sources: FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (phishing/spoofing was the most-reported crime type with 191,561 complaints; age 60+: 201,266 complaints, $7.7 billion in losses). Have I Been Pwned homepage, read 2026-10-13 (17,845,803,111 pwned accounts, 1,044 pwned websites). National Cybersecurity Alliance, Cybersecurity Awareness Month 2026. TechSpot, “Google denies Gmail reads emails and attachments to train AI” (Gmail smart features on by default; Google says Gmail content is not used to train Gemini).
Previous in Privacy Guides: Gmail Built a Screen That Lists Everything You Forgot You Let In
