Compromised Email and What It Reaches
Email is the recovery path for everything else. An attacker with it does not need your passwords.
Priya Raman · 2 min read
Most account takeovers start with email, because email is where password resets go.
What email access provides
Password resets on every account registered to it, which is typically all of them.
Two-factor bypass where a service permits recovery by email.
Information for social engineering: which venues you use, your balances from notification emails, your name and address from receipts, your contacts.
Persistence. Forwarding rules configured by an attacker survive a password change and are invisible unless you look for them.
That last one is the detail most people miss during recovery.
How email gets compromised
Password reuse. A breach elsewhere provides credentials that work.
Phishing. A login page that is not the login page.
SIM swap where the account uses SMS recovery.
Session token theft by malware, which bypasses authentication entirely.
Recovery question weakness. Answers that are publicly discoverable.
The configuration that matters
A dedicated address for financial accounts. Not used for anything else, not published, not given to services that might leak it.
This single change removes most of the exposure, because the address never appears in a breach.
Hardware key two-factor on the email account itself. It is the most important account you have and it is frequently the least protected.
No SMS recovery. Remove the phone number if the provider permits it.
Review forwarding rules and connected applications periodically. Both are places attackers establish persistence.
Different passwords everywhere, which means a password manager, which should itself be protected by a hardware key.
The venue side
An attacker with email access will attempt to reset exchange credentials. What stops them is authentication that email cannot recover.
Hardware two-factor that is not resettable by email.
A withdrawal address allowlist with a delay, which means even a successful takeover cannot move funds immediately.
Notification settings enabled on every event, so an attempt is visible.
Venues that support all three, such as an exchange you can actually contact, make an email compromise survivable. Venues where email recovery can reset everything do not.
If email is compromised
Order matters.
- Regain access and change the password from a clean device
- Revoke all active sessions
- Check and remove forwarding rules and connected applications
- Check the sent folder for what was sent from your account
- Then work through every account registered to that address, starting with financial ones
- Enable hardware two-factor everywhere it is supported
Step three is the one that gets skipped, and skipping it means the attacker retains access after everything else is fixed.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.