Email basics & safety

Your email account is more important than almost any other account you own — not because of what's stored in it directly, but because of what it can unlock. This lesson covers why, and the habits that keep it protected.

Why email is the "master key" to your digital life

Think about how many other accounts use your email address as the login, and how many of them let you reset your password by clicking a link sent to that same email. If an attacker gets into your email, they don't just read your messages — they can often use "Forgot password?" to take over your bank, social media, and shopping accounts one by one, using your own inbox against you.

Every protection covered in the passwords & accounts lesson — a strong unique password, and especially 2FA — matters most on your email account specifically, precisely because of this master-key effect.

How email actually works, briefly

When you send an email, it doesn't travel directly to the recipient — it hops between mail servers until it reaches their inbox. Critically, basic email was never designed with strong sender verification built in, which is exactly why spoofing (an email claiming to be from someone it isn't) has remained possible for decades, and why the next section matters.

Recognizing a suspicious email

A few reliable warning signs, worth checking every time something feels slightly off:

Urgency and pressure — "Your account will be suspended in 24 hours," "Immediate action required." Legitimate organizations rarely create this kind of artificial time pressure.
A mismatched sender address — the display name might say "Amazon Support," but the actual email address behind it is something unrelated. Most email apps let you tap or hover on the sender name to reveal the real address.
Links that don't match where they claim to go — hovering over (or long-pressing, on mobile) a link before clicking usually reveals the real destination address at the bottom of the screen.
Requests for sensitive info via email — legitimate banks and services essentially never ask you to email your password or full card number directly.
Unexpected attachments, especially from someone you weren't expecting to hear from, or in a format you don't recognize.

Rather than clicking a link in a suspicious email, open a new browser tab and type the organization's real address yourself, or use an app you already have installed. This single habit defeats the vast majority of phishing attempts regardless of how convincing the email looks, because it removes the fake link from the equation entirely.

A few practical email habits

Use a separate email address for signups and newsletters if you can, keeping your primary address more private and reducing the amount of spam and phishing attempts it's exposed to.
Don't forward suspicious emails to "check if it's real" with friends or family unless you trust their judgment — this can unintentionally spread a scam further.
Report phishing using your email provider's built-in "Report phishing" button rather than just deleting it — this helps your provider's spam filters improve for everyone.

🧪 Hands-on lab — audit your own inbox habits

Check your primary email account: does it have a strong, unique password and 2FA enabled (from the passwords lesson)? If not, fix that first.
Look through your inbox for anything that matches the warning signs above, without clicking any links — just practice spotting them.
Find your email provider's "Report phishing" button and note where it is, so you're ready to use it next time.
Consider setting up a separate email address for online shopping and newsletter signups if you haven't already.

Why does compromising someone's email account often give an attacker access far beyond just their messages?

Show answer

Because so many other accounts use email-based "Forgot password?" flows for recovery, an attacker who controls someone's inbox can typically reset the password on their bank, shopping, and social media accounts one at a time, using the compromised inbox to receive and approve each reset — turning one compromised account into many. This is exactly why email deserves the strongest protection (unique password plus 2FA) of any account someone owns.

Key terms

Spoofing — sending an email that falsely appears to come from a different sender.
Phishing — a message designed to trick you into revealing sensitive information or clicking a malicious link (covered in full depth in the next lesson).

Recap

Your email is the "master key" to most of your other accounts through password-reset flows — protect it above all else.
Watch for urgency, mismatched sender addresses, and links that don't match their claimed destination.
When in doubt, navigate to a site directly instead of clicking a link in an email.
Use your provider's "Report phishing" feature rather than just deleting suspicious messages.

Next up → Passwords & accounts basics