Email remains one of the most common ways cybercriminals attempt to steal personal information or gain unauthorized access to accounts. Knowing how to identify phishing attempts, manage spam effectively, and follow basic security practices can help keep your email account and personal data safe.

1. Create a Strong, Unique Password

1. Create a password that is at least 12–16 characters long.
2. Use a combination of uppercase and lowercase letters, numbers, and special characters.
3. Avoid using personal information or reusing passwords across multiple accounts.
4. Use a trusted password manager to generate and securely store strong passwords.

2. Enable Multi-Factor Authentication (MFA)

1. Sign in to your email account's security settings.
2. Enable Multi-Factor Authentication (MFA).
3. Use an authenticator app whenever possible instead of SMS verification.
4. Store your recovery codes in a secure location.

3. Recognize Phishing Emails

1. Check the sender's email address carefully before opening or responding to a message.
2. Be cautious of unexpected requests for passwords, verification codes, or financial information.
3. Watch for poor grammar, spelling mistakes, or unusual formatting.
4. Verify that links point to the websites they claim to open.
5. Treat unexpected attachments with caution, especially ZIP, EXE, or Office files that ask you to enable macros.

4. Verify Links Before Clicking

1. Hover over links to preview their destination before clicking.
2. On mobile devices, press and hold a link to view its destination.
3. Confirm that the website uses the correct domain name and HTTPS encryption.
4. If you are unsure, manually type the company's official website into your browser instead of using the link in the email.

5. Open Attachments Safely

1. Open attachments only from trusted senders.
2. Scan downloaded files with your antivirus software before opening them.
3. Never enable macros in unexpected Microsoft Office documents.
4. Delete suspicious attachments immediately.

6. Configure Spam and Junk Email Filters

Improve Spam Protection

1. Enable your email provider's spam protection.
2. Mark unwanted emails as Spam or Junk instead of simply deleting them.
3. Block repeat senders when necessary.

Customize Your Email Filters

1. Create custom email rules to automatically filter suspicious messages.
2. Add trusted contacts to your Safe Senders list.
3. Review blocked senders and spam filter settings regularly.

7. Keep Your Devices Updated

1. Install operating system updates as soon as they become available.
2. Update your web browser and email application regularly.
3. Keep your antivirus software current with the latest security definitions.
4. Enable automatic updates whenever possible.

8. Review Your Account Security

Check Recent Account Activity

1. Review recent sign-in activity for unfamiliar devices or locations.
2. Remove devices you no longer use.

Verify Recovery and Connected Apps

1. Review connected applications and remove any you do not recognize.
2. Confirm that your recovery email address and phone number are current.
3. Change your password immediately if you suspect unauthorized access.

9. Report Suspicious Emails

1. Use your email provider's Report Phishing or Report Spam feature.
2. Delete confirmed phishing emails after reporting them.
3. Notify your IT administrator if the suspicious email was received through a work account.

10. Know What Legitimate Organizations Will Not Request

1. Share your password by email.
2. Provide one-time verification codes.
3. Send sensitive financial information through email.
4. Install unknown software from unsolicited messages.
5. Verify your account through unexpected email links.

If phishing attempts or spam continue after completing the steps above, try the following solutions.

Spam Emails Continue to Reach Your Inbox

Improve Spam Detection

• Confirm that spam filtering is enabled.
• Continue marking unwanted emails as Spam instead of deleting them.
• Block persistent senders.
• Check your spam folder settings.

Refine Your Filtering Rules

• Create custom filtering rules based on senders, keywords, or domains.
• Increase your email provider's spam protection level if available.
• Review forwarding rules to ensure messages are not bypassing spam filters.

Legitimate Emails Are Going to the Spam Folder

Restore Trusted Messages

• Check your Spam or Junk folder regularly.
• Mark legitimate emails as Not Spam.
• Add trusted contacts to your Safe Senders list.

Review Email Filtering Settings

• Review custom email rules that may be moving messages incorrectly.
• Check domain allowlists and email filtering policies if you use a business email account.

You Clicked a Suspicious Link

1. Close the webpage immediately without entering any information.
2. Run a full antivirus and anti-malware scan.
3. Change your email password using a trusted device.
4. Verify or enable Multi-Factor Authentication (MFA).
5. Review your recent account activity for unauthorized access.

Your Email Account May Be Compromised

Common signs include:

• Password reset emails you did not request.
• Emails sent without your knowledge.
• Login alerts from unfamiliar devices or locations.
• Unexpected changes to your account settings or forwarding rules.

If you notice any of these warning signs:

• Change your password immediately using a trusted device.
• Sign out of all active sessions.
• Remove unfamiliar recovery methods and connected applications.
• Scan every device used to access your email account for malware.

Strengthen Your Email Security

• Enable notifications for new sign-in attempts.
• Check mailbox forwarding rules regularly to ensure they have not been changed without your knowledge.
• Disable legacy authentication methods if your email provider supports them.
• Use a password manager to create and store unique passwords.
• Periodically review connected applications and remove any you no longer use or recognize.
• Keep your operating system, browser, antivirus software, and email application up to date.

• Never share your email password, one-time verification codes, or recovery codes with anyone.
• Verify the sender's email address before opening attachments or clicking links.
• If you are unsure about an email, access your email provider by manually entering its official website into your browser.
• Keep your operating system, browser, antivirus software, and email application up to date.
• If you suspect your account has been compromised, change your password immediately using a trusted device, enable Multi-Factor Authentication (MFA), and perform a full malware scan.
• Avoid accessing sensitive email accounts on public Wi-Fi unless you are connected through a trusted Virtual Private Network (VPN).
• Report phishing emails before deleting them whenever possible to help improve spam detection.