Protect the email account that holds everything together
Your email can be the route back into banking, shopping, social media and other important services. Giving it some attention is a useful place to begin.
What to have ready
Use the email provider's official app or website. Never send your password or recovery codes to Umbrello.
Who it helps
Anyone with a personal email account, or an adult helping someone with their permission.
The checks to make
1. Use a strong password you don't use elsewhere.
If your email password is shared with another service, change it. A password manager can help you create and keep track of different passwords.
I've reviewed my email password.
2. Add another sign-in check.
Turn on two-step verification where your provider offers it. Follow its official instructions and keep recovery codes somewhere safe. Don't approve a sign-in request you didn't initiate.
I've reviewed my sign-in protection.
3. Check your recovery options.
Make sure recovery phone numbers and email addresses are current and controlled by you. Think about how you would get back in if your usual phone were lost.
I've checked my recovery details.
4. Know what to do if access changes.
Find your provider's official recovery process before you need it. If you suspect someone else already has access, use the account-recovery guidance on our Something happened page.
I know where to find account-recovery help.
A conversation worth having
If someone in the family lost their phone or access to email, who could help them find the official recovery process?
Limits and things to watch for
These steps reduce risk but cannot prevent every scam or account compromise. Never share security codes in response to an unexpected message or call.
Spot something inaccurate in this guide?Share feedback
Related guides
Six useful checks for your digital household
A shared starting point for adults, children and relatives you support. Choose the checks that fit your circumstances and work through them together where appropriate.
A household plan for account access and recovery
How to keep a secure record of important accounts, recovery details, and trusted contacts who could help if someone lost access.
Pause before a suspicious payment request
Unexpected requests can appear to come from a relative, company or someone you trust. A short pause and a separate check can help you avoid acting on a false story.