Try this: open your email right now and search “password reset”. We reckon you’ll find dozens, maybe hundreds, going back years. Banks, super funds, Medicare, your kid’s school portal, that online shop you used once in 2019. Every one of those accounts trusts your inbox to prove it’s really you. That’s the bit people miss when they’re busy agonising over which streaming password to change. Securing your email account isn’t one item on a long list of digital chores. It’s the lock that every other lock depends on, and it rarely gets the attention it deserves.
We’ve written plenty in this section about scam calls and dodgy texts, and those still matter. But if someone gets into your email, they don’t need to trick you again at all. They just click “forgot password” on everything else and wait for the reset links to roll in. So this one gets a proper, step-by-step afternoon rather than a five-minute tidy-up before dinner.
Why email is the master key to your digital life
Here’s the plain-English version of why this matters more than, say, your Netflix password. Almost every online account uses email as its recovery method, meaning if you forget your password, a reset link gets sent straight to your inbox. Your bank might text you a code too, but the email is usually still part of the chain somewhere, often as the fallback option. Get into someone’s email and you can often reset their banking, their superannuation login, accounts linked to myGov, even their mobile carrier account. From there it snowballs fast, and the person on the receiving end often doesn’t notice until something’s already gone.
The Australian Cyber Security Centre, which runs ReportCyber and publishes the government’s day-to-day cyber advice, lists account compromise through email as one of the most common ways attackers get a foothold in someone’s personal life. There’s often no malware involved at all. It’s just a weak or reused password, or a tired click on a link at 11pm when you’re not really paying attention.
The password problem, and why reusing one is the actual risk
We’ll say the mildly unpopular thing here: most password advice focuses on complexity, and we don’t think that’s really the point any more. A fourteen-character password full of symbols is fine, genuinely, but if you use that same password on your email and on some forum you signed up to back in 2015, and that forum gets breached, your email is exposed too, symbols and all. Attackers don’t sit there guessing passwords one by one these days. They take leaked password lists from old breaches and run them against other sites automatically, a technique called credential stuffing. It works precisely because people reuse passwords so often.
So the single highest-value thing you can do this afternoon isn’t making your email password more complicated. It’s making sure it isn’t used anywhere else, ever. A password manager handles this without you having to memorise forty different strings of nonsense, and it’s genuinely less hassle than it sounds once it’s set up. We’ve put together a proper comparison in our password managers comparison for 2026, and honestly, if you only click through to one other thing on this site today, make it that one.
Turn on two-factor authentication, properly
Two-factor authentication, often shortened to 2FA, means that after you type your password, the service asks for a second proof that it’s really you, usually a short code. Most Australian email providers support it, and most people have simply never turned it on. We get why. It feels like friction for not much obvious benefit, an extra tap between you and your inbox. But it’s the one setting that stops a leaked password being enough on its own to get someone in.
A few things worth knowing before you flip the switch, since not all 2FA is built the same:
- SMS codes are better than nothing, but they can be intercepted through SIM-swap scams, where a scammer convinces your telco to move your number onto their SIM card. An authenticator app, built into most phones now, sidesteps that weakness entirely.
- Write down or screenshot your backup codes when the service offers them, and store that somewhere other than inside your email itself. Sounds obvious. People still store the backup codes for their email inside their email, which defeats the purpose.
- If your provider offers a physical security key, that’s the strongest option going, but for most people an authenticator app is more than enough protection for the effort involved.
Check recovery details and clean out old connected apps
This is the step people genuinely forget exists. Every email account has a recovery phone number and sometimes a secondary recovery email attached, often set up years ago, possibly to a number you cancelled when you changed telcos or a university email address that’s been dead since 2016. If that old number has since been reassigned to a stranger, which happens more than you’d think once numbers get recycled, there’s a sliver of a chance someone else could use it to get in. Go into account settings this afternoon, find “recovery options”, and bring it up to date. It takes about ninety seconds and it’s the kind of thing that sits ignored for a decade without anyone noticing.
While you’re in there, most providers also let you see a list of apps and devices with ongoing access to your account, usually tucked under “security” or “connected apps”. We’d bet most people have never looked at this screen once. It tends to include a phone you sold two years ago, an app you tried for a week and forgot about, a laptop you handed down to your nephew. Remove anything you don’t recognise straight away. If you spot a device or a login location you genuinely don’t know at all, don’t wait: change your password immediately and check recent activity for anything else out of place while you’re there.
Why the next quishing text might target your email, not your bank
We’ve covered how quishing scams work via QR codes before, and the same trick increasingly shows up aimed squarely at email accounts rather than banks. The logic makes sense once you think it through: a fake “your account will be suspended” email pushes you toward a lookalike login page, and if you type your real password in there, the scammer now owns the master key to everything else, not just one account. It’s a bigger prize than a single bank login, and scammers know it.
The giveaway is usually in the web address, not the design, since scam pages can look identical to the real thing now, right down to the logo. Before typing a password anywhere you clicked through from an email, check the address bar carefully. If it’s not the exact domain your provider actually uses, close it and go to the service directly, either by typing the address yourself or using a saved bookmark. The ACCC’s Scamwatch service tracks these patterns nationally and is worth a look if you want to see what’s currently doing the rounds in Australia.
What your old, forgotten accounts are still holding onto
Your inbox is also a historical archive of everywhere you’ve ever signed up. Old retailers, old forums, old subscriptions you forgot you had entirely. Each one is a potential future breach waiting to expose your email address and, if you’ve reused it, a password that still opens other doors. We’ve written about downloading your data from social media as a good first step in understanding exactly what’s out there with your name attached to it, and the same instinct applies more broadly here: fewer accounts floating around out there means fewer ways in for anyone with bad intentions.
If you want to know whether your email address has already turned up in a known breach somewhere, the Office of the Australian Information Commissioner’s Notifiable Data Breaches scheme page explains what organisations are legally required to tell you when your data is exposed, and it’s a decent starting point for understanding your rights if it ever happens to you personally.
Don’t forget the network your email travels over
None of this matters as much if the home network carrying your email traffic is itself wide open. An old router with factory default settings, or one still running firmware from years ago, is a softer target than most people’s actual email provider these days. We’ve put together a full home router security checklist covering the handful of settings worth checking, most of which take less time than making a cup of tea. It’s not the flashy part of email security, but it’s the part that quietly undermines everything else if it’s ignored.
We’d also gently push back on the idea that a VPN is the thing most households need to worry about next. It gets spruiked constantly as the next must-have privacy tool, and for specific situations, like using public WiFi at an airport, it genuinely helps. But for most people sitting at home, a locked-down email account and a decent router setting matter far more day to day. We’ve laid out our actual reasoning on that one in our VPN explainer for 2026 if you want the fuller argument.
Our take: do it in this order, not all at once
If you’ve read this far, don’t try to do all five steps in one sitting and burn out halfway through updating recovery details on an account you haven’t logged into properly since 2017. Our actual advice, slightly against the grain of most “fix everything right now” security advice, is this: unique password first, two-factor second, everything else can wait a week.
Those two steps alone close off the overwhelming majority of the ways email accounts actually get compromised, based on what the ACSC consistently flags as the common pattern behind real incidents it sees reported. The recovery details, the connected apps audit, the old account clean-up, the router check, those all matter, but they’re maintenance, not triage. Get the two big ones sorted this afternoon over a cup of tea, and let the rest wait until the weekend if it has to.
Once your email is locked down properly, every other account resting on top of it gets safer almost automatically, without you having to touch each one individually. That’s really the whole point of starting here instead of anywhere else. One good lock, fitted properly, beats forty mediocre ones every time.
