20/02/2025
Why is it CRITICAL to ensure your email account password is DIFFERENT from everything else? Ideally every password should be different, for every site - but of all the ones that MUST be unique, email is the one...!
We explain this a lot to our customers, particularly after helping them recover from being hacked - so thought it would be helpful to explain why it's so important, and maybe protect others from the horrible consequences of an email hack...so here goes.....
When you forget a password for a website, how do you reset it? Let's say you forget your Amazon.co.uk password.....Typically, you'll click the "Forgotten password?" link on their login page, and then enter your email address. Amazon sends you an email, knowing that only you have access to that email account - so they know it's really you who's resetting the password. You click the link in the email, enter a new password, and you've securely reset your password. Nobody else can do that, because they don't have access to your emails...so effectively your email is your master key for all your other accounts and logins for other websites...
So why is it so important to ensure that password is different from all your other passwords?
Let's imagine the following scenario:- You've registered with three websites (e.g. BBC iPlayer, Sainsburys, and dailymail.co.uk) all using [email protected] to identify it's you, and all using "Primary1999Keys" as the password... AND, you've also used "Primary1999Keys" as your password for your email account...
Then, one day dailymail.co.uk gets hacked - they lose all their user account details, INCLUDING the email addresses and passwords of all their users (this happens more often than you might think...) The hacker now has thousands or millions of email/password combinations...
The hackers aren't interesting in accessing your dailymail.co.uk account - but because the hackers know that the majority of people use the same passwords, the FIRST thing they do is try to login to your email, by going to gmail.com and logging in with [email protected], and "Primary1999Keys" - they get in, and can now see ALL your emails, sent, received, filed away etc. etc.! They can also get a good idea of all the website you've registered with, and can start to target them....
First, they setup some hidden rules in your email that silently forwards ALL your incoming emails to their own email address, and then hides them from you.....so you won't realise you've been hacked at all!
Next, they go to Paypal.com (for example), and use the "Forgotten Password?" link. Paypal sends you an email to allow you to reset your password, sent to [email protected] - This is silently forwarded to the hacker - and they use the link in the email to securely reset the password. They can then buy things with your Paypal account, send money to themselves etc.
Then, they login to your Facebook account and reset the password, and the personal details, and pretend to be you with all your friends, trying to persuade them to send money etc...
So once they're into your email, they can reset and access just about ANYTHING...
So what can you do to protect yourself?
1. Ensure your email password is COMPLEX and UNIQUE - it must NEVER be used anywhere else.
2. Turn on 2FA (Two Factor Authentication) for your email, if it supports it (GMail, Outlook, iCloud all support it.) Once turned on, any new login to your email account will ALSO need a code from your mobile device, or to another email account, to enter when logging in. NEVER give these codes to anyone else - if you receive one unexpectedly, someone's got your password, and is trying to hack your account...so you should act quickly (give us a call).
3. Turn on 2FA for all other accounts you can, particularly anywhere you can do anything with money - order something online, order gift cards, subscribe to a service, transfer money etc - e.g. Amazon, Paypal, eBay, Sainsburys, Tescos etc.
If you'd like help with any of the above, do give us a call and we can help.