In short and in plain language
Your email inbox is like a key to your other accounts. Whoever has it can ask for a new password there.
The article shows how to protect your inbox better. Check that your backup address and phone number are correct.
An extra code when you sign in helps. Then a stolen password alone is no longer enough.
Also look at which devices are signed in. Unknown forwarding rules are a quiet warning sign.
Last, you tidy up your inbox. We are happy to go through it with you at your home.
There is one account that sits above all the others, and most people treat it like any other: the email mailbox. Anyone with access to it does not need to know a single further password. They simply request a new one from the bank, the mail-order shop, the energy supplier and the social network, because the link for that lands in the mailbox. The mailbox is therefore not one account among many, but the key ring for all the rest. How often this turns into damage is shown by the Cybersicherheitsmonitor 2026 published by the German Federal Office for Information Security and the police crime prevention programme: 11 percent (Cybersicherheitsmonitor 2026) of internet users were affected by an online crime in the previous year alone. This article works through the account check step by step: keeping recovery options current, setting up two-factor sign-in, securing backup codes, checking signed-in devices and unfamiliar forwarding rules, tidying the mailbox and keeping your own address. Without jargon, in an order you can complete in one afternoon.
Key takeaways
- The mailbox is the recovery route for almost every other account. Anyone who takes it over does not need the remaining passwords, but simply requests them again one after another.
- 11 percent (Cybersicherheitsmonitor 2026) of internet users were affected by an online crime in the previous year alone; 27 percent (Cybersicherheitsmonitor 2026) have been affected at least once.
- Among those affected in the past year, 14 percent (Cybersicherheitsmonitor 2026) report unauthorised access to online accounts and 12 percent (Cybersicherheitsmonitor 2026) report phishing.
- Two-factor sign-in is used by 40 percent (Cybersicherheitsmonitor 2026) of respondents. It still holds when the password has already fallen into the wrong hands, because a stolen password alone is then no longer enough.
- Unfamiliar forwarding rules are the quiet sign of a hijacked account: the post keeps arriving as usual and is copied on top. That list appears in no warning message, only in the settings.
Why the mailbox is the master key
Almost every online service has the same emergency exit: "forgot password". You enter your email address, receive a link and set a new password. That route is convenient as long as only the authorised person can see into the mailbox. It reverses as soon as somebody else has access there. Then the order is not bank, mail-order shop, social network, but the mailbox first and the rest at leisure afterwards. This is precisely why it pays to secure one single account better than all the others.
The figures come from the Cybersicherheitsmonitor, an annual survey run by the Federal Office for Information Security and the police crime prevention programme among more than 3,000 internet users aged 16 and over in Germany. 27 percent (Cybersicherheitsmonitor 2026) of respondents have already been affected by cybercrime, 11 percent (Cybersicherheitsmonitor 2026) in the previous year alone. Among those affected in the past year, 88 percent (Cybersicherheitsmonitor 2026) report damage and 33 percent (Cybersicherheitsmonitor 2026) a financial loss. One point matters for reading these numbers: the percentages for individual offences refer to the group of affected people, not to all respondents.
The one account that unlocks all the others
Recovery: the address and the phone number that count
The first step takes five minutes and is still rarely done: check which second address and which phone number are stored with your mailbox provider. In many accounts you still find the address of a former employer, the number from an old contract or the address of a child who has long since moved out. These entries are not a detail. They decide who gets the mailbox back when the password is lost, and they equally decide who can take it over if they fall into the wrong hands.
A combination of two routes makes sense: a second address you genuinely have access to, and a mobile number that sits on your own device. Anyone who stores only one route faces a locked door as soon as that route is gone. Anyone who creates the second address with the same provider as the main mailbox typically loses both at once during an outage. The phone number should also belong to a card that is still active; deactivated prepaid numbers are reassigned after a while.
- Enter a second address held with a different provider and one you access regularly.
- Check the mobile number and replace it if it is outdated, then test reception once.
- Treat the answer to a security question, if your provider requires one, like a password and note it separately.
- Cross-check the address stored with your most important services: bank, government portal, retail, energy supplier.
- Put a date in the calendar to look at these entries once a year.
Second address
It receives the recovery link when the main mailbox cannot be reached. It should sit with a different provider so that one outage does not take out both routes at the same time.
Current phone number
It is the second way back and at the same time a possible second factor. A number that has not been used for years may have been reassigned and should be replaced.
Allow for waiting time
Providers review recovery requests and deliberately let time pass. Anyone who only sets up access when it is already needed typically waits several days for an answer.
Setting up two-factor sign-in and securing backup codes
Two-factor sign-in asks for a second proof alongside the password: a numeric code from an app, a confirmation on the phone or a small security key. A stolen password on its own is then no longer enough. Even so, the method is not widespread: 40 percent (Cybersicherheitsmonitor 2026) of respondents use it, compared with 34 percent the year before. Passwordless sign-in reaches 21 percent (Cybersicherheitsmonitor 2026). Strong passwords are used by 46 percent (Cybersicherheitsmonitor 2026), and on average respondents use just under 4 of the 19 (Cybersicherheitsmonitor 2026) protective measures surveyed.
When setting it up, one rule that the Federal Office for Information Security states explicitly applies: the two factors should come from different categories, that is knowledge, possession and biometrics. A code that arrives on the same phone used for the sign-in separates the factors only partially. In practice this means: if you sign in on a computer, use the phone as the second factor, and if you sign in on the phone, the code is ideally somewhere else. For everyday use at home, an authenticator app on the phone plus printed backup codes is a combination that is straightforward to set up and to explain.
- Open the sign-in and security section in the mailbox account settings.
- Activate two-factor sign-in and choose an authenticator app as the method if your provider offers one.
- Enter the displayed code once as a test while the old session is still open.
- Display the backup codes, print them and file them with the papers your relatives can reach in an emergency.
- Register a second device as a factor so that a lost phone does not block access.
- After setting it up, sign out once and run through the sign-in from start to finish.
Backup codes belong on paper
Spotting unauthorised access: devices, sessions, forwarding rules
A hijacked mailbox usually looks unremarkable. Whoever gained access rarely changes the password, because that would be noticed straight away. Instead the post stays as it is and is copied on top. Among those affected in the past year, 14 percent (Cybersicherheitsmonitor 2026) name unauthorised access to online accounts and 12 percent (Cybersicherheitsmonitor 2026) name phishing as what happened to them. Both routes often end in the same result: somebody is reading along.
The traces are in the settings, not in a warning message. Three lists are worth a look: the signed-in devices, the active sessions and the forwarding or filter rules. The last list in particular is rarely opened. A rule that automatically forwards messages containing certain keywords and then marks them as read or moves them to the bin is invisible from the outside and keeps running quietly. Anyone who finds one should delete it, change the password and then switch on two-factor sign-in so that the change holds.
- Review the signed-in devices and sign out everything you cannot account for.
- End active sessions and change the password afterwards so that old access does not persist.
- Open forwarding rules and filters one by one; delete rules with no recognisable purpose.
- Check the out-of-office reply and the signature for unfamiliar addresses or links.
- Go through connected apps and access rights and remove anything no longer in use.
- Skim the sent items folder: anything there that did not come from you is a clear sign.
The quiet rule in the mailbox
Passwords: one per login, long enough
The Federal Office for Information Security describes two workable ways to build a password. A short and complex password should be at least eight characters (BSI) long and use four character types, a long and less complex one at least 25 characters (BSI). The second approach is often the more comfortable one in everyday use, because a sequence of four or five words is easier to remember and quicker to type than a short string with special characters. Something else matters just as much: a password should be used for one single login only, because published credentials are tried out by attackers at all kinds of services.
| Construction | Minimum length | Character types | What it suits |
|---|---|---|---|
| Short and complex | 8 characters (BSI) | four types: upper case, lower case, digits, special characters | Logins typed frequently where a manager does not step in |
| Long and simpler | 25 characters (BSI) | two types are enough, such as a sequence of words | The master password of the manager and the mailbox itself |
| From the password manager | generated by the program | all types, randomly mixed | Every remaining account, since they are not typed anyway |
| Reused in several places | unsuitable | makes no difference | No use case: one leak covers many accounts at once |
In practice it comes down to a division of labour: you remember two passwords yourself, the one for the mailbox and the one for the password manager. The program creates and keeps all the others. How to set up such a manager and how the existing scraps of paper move into it is described step by step in the article on the password manager.
Two more figures from the same survey help with the context: 8 percent (Cybersicherheitsmonitor 2026) of respondents use no protective measure at all, and for updates 26 percent (Cybersicherheitsmonitor 2026) have switched on automatic installation while 24 percent (Cybersicherheitsmonitor 2026) update regularly by hand. Current software is part of mailbox protection, because an outdated browser can get around even good access protection. The same applies to the home network: the article on the router and home network shows which settings count there.
Tidying the mailbox: filters, folders, newsletters
Security and order are more closely linked in a mailbox than it first appears. In an inbox with several thousand unread messages a forged invoice does not stand out, and a genuine warning from the provider disappears in the pile. Tidying up therefore improves not only the overview but also the chance of noticing the unusual. The order for doing it is simple: unsubscribe first, then filter, then archive.
Unsubscribing has a lasting effect, because it lowers the volume instead of moving it around every day. Reputable newsletters carry an unsubscribe link at the bottom; one click is usually enough. Unwanted advertising from unknown senders is a different matter: there, unsubscribing only confirms that the address is read. Such messages are better handled through the provider's spam function so that future post from the same sender is sorted out straight away.
- Unsubscribe from newsletters as they arrive for two weeks instead of deleting them; after that the list is short.
- Create one folder each for recurring senders such as the bank, the insurer or a club.
- Set filter rules that put these senders straight into the matching folder and leave them unread.
- Archive invoices and contracts in a folder for the year and take them out of the inbox.
- Limit the inbox to the messages that still need a reply.
- Once a month, take a short look at the folder structure and adjust filters that no longer fit.
Storage, moving house and your own address
A full mailbox is more than a blemish: once the storage is used up, the provider typically accepts no new post and the sender receives an error message. The space is taken up almost entirely by attachments, not by text. Anyone who sorts by message size finds the twenty emails that together need more room than ten years of correspondence. Photos and documents from them belong in an orderly archive rather than in the inbox anyway; what that looks like is shown in the article on data backup.
Changing provider raises a second question: the address itself. Anyone using an address supplied by their internet provider often loses it when the contract changes. An address that exists independently of a contract is therefore calmer in the long run. The move itself runs in three steps: create the new mailbox, transfer the old post, then change the stored address with your important services and keep the old mailbox running as a forwarder for a few months until nothing important arrives any more. The new mailbox gets its own sufficiently long password straight away, one that appears nowhere else. If you want to handle contracts and forms digitally in the meantime, the practical steps are in the article on filling in and signing PDF files.
Ein langes und weniger komplexes Passwort sollte mindestens 25 Zeichen lang sein.
A final point concerns being reachable without power and without a network. Credentials, backup codes and the second address are of little use if they sit exclusively in a device whose battery is flat. A printout in a fixed place solves that problem without any technology. Which devices in the household keep running during an outage and which do not is described in the article on a power outage at home.
How the account check works in your home
Access and second factor
We look at the recovery routes together, set up two-factor sign-in and print the backup codes. You decide where the sheet is kept.
Devices and rules
Signed-in devices, active sessions, forwarding rules and connected apps are worked through list by list, and anything that does not belong is removed.
Order in the mailbox
Folders, filters and unsubscriptions are set up so that the inbox stays manageable. A handout afterwards records what was set where.
The appointment takes place in your home, on your device and with your own logins, so that the settings end up where you need them. If you would rather practise calmly and step by step, the email course is the right place; if you want to understand the settings around data and advertising, the data protection course covers them. For older people we offer the same with more time and larger type under tech help for seniors. What an appointment costs is on the pricing page, and anyone living in the Hildesheim area will find the overview under tech help in Hildesheim.
Sources and studies
Related Articles
Digitize paperwork: scan, sort and find it again
Emptying binders, scanning documents and finding them again: resolution, file names, retention periods and the backup without which none of it holds.
Organize Your Photos: Tame the Phone Chaos
Phone full of photos? Bring order to the chaos: sensible albums, declutter duplicates, find again by face and place search - set up at home near Hildesheim.
Spotting fake shops: order safely before Black Week
Spot fake shops before Black Friday: five warning signs, a checklist before you order, safe ways to pay and what to do first if your money is already gone.