Worth Your Time: Your Email Is the Master Key to Your Whole Life. Here’s How to Keep It.

Most of us think of email as the place where newsletters and family photos land. Scammers see it differently. To them, your inbox is the master key that opens your bank, your pharmacy, your social media — and everyone you’ve ever written to.

AARP just published a clear, practical guide on preventing an email hack and recovering from one, and it earns a spot here because it doesn’t stop at “be careful.” It opens with a woman who teaches technology classes for seniors — including classes on suspicious email — who still clicked a fake party invitation that looked like it came from her cousin. Google flagged the break-in attempt within moments and she shut it down, but the point lands: this can happen to anyone, including people who know better.

The numbers explain why. A 2026 Worldmetrics report found phishing was behind about 82% of email hacks, and the Identity Theft Resource Center saw unauthorized access to people’s devices rise nearly 12% this year. Since most of us stay signed in to email on our phones, a stolen or unlocked phone can mean a wide-open inbox.

Here’s the part that should make everyone sit up. Once crooks are inside, they can click “forgot password” on your other accounts and have the reset links sent straight to them. They can dig through old messages for account numbers or your Social Security number. And they can use AI to read your sent mail, learn who your closest friends are and what you’ve been talking about, then write to those friends pretending to be you — stranded, embarrassed, and needing money fast. A hacked inbox doesn’t just put you at risk. It puts everyone in your contact list at risk too.

Signs Someone Got In

• Your password suddenly stops working, or you get a notice that it was changed and you didn’t do it.
• You get an alert about a sign-in from a device or place you don’t recognize.
• Your Sent folder has messages you never wrote.
• A friend calls to ask about the odd email you “sent” them.

The Short Version: If It Happens to You

1. Contact your email provider. Gmail, Outlook, and Yahoo all have account-recovery steps for hacked accounts, even if you’re locked out.
2. Change your email password first, then the rest in order of importance: banking, medical, social media, then everything else.
3. Sign out of every device. Google, Apple, and Microsoft all let you kick everyone off your account at once from one screen.
4. Warn your contacts. A quick note — “I was hacked; ignore anything strange from me and don’t click the links” — can save a friend real money.
5. Check your Sent and Deleted folders for anything the crooks sent or tried to hide.
6. Look at your settings. Make sure your security features are still turned on, and check that no one quietly set your mail to auto-forward to another address. That one is easy to miss.

Lock the Door Before It Happens

• Pause on surprise invitations, shared documents, and “you’ve got a file” emails — even from people you know. Ask yourself: would they really send this?
• Use a long password — 16 characters or more — and a different one for every account. A password manager makes this painless.
• Turn on two-step verification (also called multi-factor authentication) today. Crooks who get in will set it up with their phone number, which makes getting your account back far harder.
• Put a passcode on your phone. If you stay signed in to email there, your phone is your inbox.

Where to Get Help

• Identity Theft Resource Center: 888-400-5530 or live chat at idtheftcenter.org — they’ll help you build a recovery plan.
• AARP Fraud Watch Network Helpline: 877-908-3360 (available to anyone, member or not).
• FBI Internet Crime Complaint Center: IC3.gov, plus your local police.

📄 Read the full article: “How to Prevent Your Email From Getting Hacked — and What to Do If It Happens to You” — AARP

Jay’s Take

If you do one thing from this list, turn on two-step verification for your email today. It’s the best lock you can put on your front door, and it takes about five minutes.

More like this: All Phishing Email & Text alerts · All Identity Theft alerts

Think your email may already be compromised? Our What To Do page walks you through exactly what to do first.