Review account recovery before a scammer tries it by confirming your recovery email, recovery phone, and backup sign-in methods are current and controlled only by you. Account recovery is the provider process that verifies your identity and returns access after a lockout or hack. A stolen email address lets a scammer trigger password resets on linked bank, shopping and social accounts, so the Federal Trade Commission warns that a hacked email exposes every connected account, as explained in the FTC's hacked-email guidance. Criminals also impersonate bank support to steal login codes, the FBI reports, with more than 5,100 takeover complaints since January 2025.
Table of Contents
- Why does one email address unlock so much?
- Has your address already circulated?
- What should you check in Google, Microsoft, and Apple?
- Which login protection resists phishing?
- What should you inspect after any hack warning?
Why does one email address unlock so much?
A stolen inbox is valuable because many services send password-reset links and sign-in codes to email. If a scammer controls your inbox, they can request resets, approve access, and lock you out of connected accounts.
That risk grows when the same password is reused or second-step codes go to an outdated phone. The FBI reports takeover attacks against financial, payroll, and health-savings accounts that start with stolen login codes. Keep email access separate and harder to steal than any single linked account.
Has your address already circulated?
Entering an address at Have I Been Pwned shows which public breaches exposed it and offers future breach notices. Founder Troy Hunt has operated the service since December 2013.
Use it as an early warning, not a clean bill of health. Breach lookups cover only known disclosed breaches, so a clean result does not prove safety. If your address appears, assume scammers may hold the old password and change it everywhere it was reused.
What should you check in Google, Microsoft, and Apple?
Google instructs users to keep a current recovery email and phone under Security settings because forgotten-password and suspicious-sign-in codes go to those contacts, as described in Google's recovery-contact help. Open Security now, remove old numbers and school or work addresses, and add a current backup email you can still open.
Microsoft requires users who lost all verification methods to prove ownership through its online recovery form with prior passwords and account details, with results emailed within about 24 hours, according to Microsoft's recovery-form help. Apple lets users designate a trusted recovery contact and request recovery at iforgot.apple.com, a process that can take days because Apple verifies identity first. Test that you know your recovery contact, backup codes, and form details before you need them.
Which login protection resists phishing?
Only FIDO2 and WebAuthn passkeys, security keys, and PKI-based authentication count as phishing-resistant under guidance from CISA. SMS codes and app push approvals can still be phished or flooded with repeated prompts. Use this quick review for each important account: NIST guidance in SP 800-63B-4 supports unique passwords plus MFA and verified recovery contacts.
- Turn on MFA, preferably a passkey or security key.
- Use a unique password for email and financial accounts.
- Verify the recovery email and phone number are current.
- Remove unknown devices, backup codes, and connected apps.
What should you inspect after any hack warning?
After any hack, check mail forwarding rules, auto-replies, connected devices, and sent mail for resets you did not request. The FTC consumer guidance urges checking provider restore steps and account settings after compromise.
Delete unknown filters, sign out unknown sessions, and change the recovery settings first. Do the same review for banking and shopping accounts that rely on that email for resets. Update each account recovery contact, then send a test code to confirm it reaches only you.
You Might Also Like
- UK Data Breach Recovery: What to Do if Someone Opens an Account in Your Name
- M&S Data Breach: Why an Account Password Reset Does Not Mean Passwords Were Stolen
- Data Breach Exposed an Old Address? Why Outdated Information Can Still Be Useful to Scammers