Renata had been using the same personal Gmail account since college. It was her backup email for everything: her bank, her Amazon account, her work Microsoft 365 profile and even her health insurance portal. She never thought much about it. It was just "her old email."
One Tuesday afternoon, she got a text. Her bank was asking her to confirm a password reset she never requested. She ignored it, assuming it was spam. By Wednesday morning, her bank account showed two transfers she did not make. Someone had not hacked her bank.
They had gotten into her Gmail first, then used it to reset everything else. Renata's personal email was the master key. And someone had found a copy.
Renata's personal email account had a weak password and no multi-factor authentication. Once someone gained access to it, they used the "Forgot Password" feature on her bank's website. The reset link went straight to her compromised inbox. No special skills required. One account unlocked several others.
Most online accounts, including work-related ones, use an email address for identity verification and password recovery. If someone controls your personal email, they can reset passwords for your bank, shopping accounts, healthcare portals and potentially your work systems. You may not notice until real damage is done.
Turn on multi-factor authentication for your personal email today. This single step stops most unauthorized access attempts.
Use a strong, unique password for your personal email. Do not reuse it anywhere else.
Check which accounts use your personal email as a recovery address. Update any that are sensitive, such as banking, insurance or work-related accounts.
Review your email's connected apps and account activity. Remove anything you do not recognize.
If your personal email is linked to your work account, let IT know. They may be able to help you reduce that risk.
✔ Open your personal email account and turn on two-step verification or multi-factor authentication right now. It takes less than two minutes and makes your account significantly harder to compromise.
Personal email has a strong, unique password
Multi-factor authentication is turned on for personal email
Password recovery addresses on bank and shopping accounts are up to date
No unfamiliar apps are connected to my personal email
IT is aware if my personal email is tied to any work system
Treat your personal email like a vault, not a junk drawer. It holds the keys to almost everything else you own online.