Primary email: the starting point for financial account security

Guidance reviewed on 11 November 2026.

Your primary inbox does more than hold messages. It may receive password reset links, transaction notices and security alerts from multiple financial services. If compromised, it can give an attacker opportunities to target other accounts, conceal warnings or impersonate you to people and organizations you know.

Begin with a unique password and a strong authentication option supported by the provider. Review the registered recovery email and phone number: both should belong to you and remain accessible, rather than pointing to an old number or forgotten inbox. Keep a secure recovery alternative according to the service's instructions so losing a phone does not also mean losing email access.

Inspect active sessions, devices and connected applications, and remove unfamiliar or unnecessary access through provider settings. Review forwarding rules, filters and delegated access. Unauthorized forwarding may continue exposing messages even after a password change if the underlying setting remains active. Preserve relevant evidence before deleting important records when compromise is suspected.

If control is lost, use the official recovery process, then examine linked accounts and warn contacts if fraudulent messages were sent in your name. Contact the financial institution directly about unfamiliar transactions. Restoring login access is not the entire recovery process: correct recovery methods and settings that could permit renewed access. Repeat this review when changing devices or telephone numbers.