What To Do If a Scammer Has Your Email Address

Finding out a scammer has your email address can feel alarming — but it's also one of the most common digital security situations people face. Your email is a gateway to your accounts, your identity, and your communications, so understanding what's actually at risk and what steps to take makes a real difference.

What It Actually Means When a Scammer Has Your Email

Your email address on its own is relatively low-risk data. It's not a password, not a Social Security number, not a financial credential. But it becomes a problem because of what scammers do with it.

Common ways they use it:

• Phishing attacks — sending emails that impersonate banks, tech companies, or services you use to trick you into clicking a link or entering credentials
• Credential stuffing — if your email is part of a data breach that also exposed a password, attackers try that combo across other sites
• Spam and social engineering — flooding your inbox with offers, fake alerts, or manipulative messages designed to provoke a reaction
• Account recovery attempts — if they can access your email inbox, they can reset passwords for linked accounts

The critical distinction is whether the scammer has just your address or whether it was exposed as part of a larger breach that included passwords or personal data.

Step 1: Find Out If You've Been Part of a Data Breach

Before reacting, get informed. Services like Have I Been Pwned (haveibeenpwned.com) let you enter your email address and see whether it's appeared in known data breaches. This tells you whether the exposure was limited to your address or included passwords, phone numbers, or other details.

If your email appears in a breach that also exposed a password, that password should be treated as compromised — everywhere it was used.

Step 2: Secure Your Email Account Immediately 🔒

Whether or not a breach exposed more than your address, locking down your email account is the right move.

Change your email password to something long, unique, and not used anywhere else. A passphrase (four or more random words strung together) is both strong and memorable.

Enable two-factor authentication (2FA) on your email account. This means even if someone gets your password, they can't log in without a second verification step — typically a code sent to your phone or generated by an authenticator app. Authenticator apps (like Google Authenticator or Authy) are more secure than SMS-based 2FA, since SIM-swapping attacks can intercept text messages.

Review your account's active sessions and connected apps. Most email providers show where your account is currently logged in and which third-party apps have access. Revoke anything unfamiliar.

Check your email settings for:

• Forwarding rules (scammers sometimes set up silent forwarding to intercept your mail)
• Auto-reply configurations
• Filters that could be silently deleting security alerts

Step 3: Change Passwords on Linked Accounts

Your email is the master key to your digital life. Most password resets flow through it. If a scammer can access your inbox, they can take over any account tied to that address.

Prioritize accounts in this order:

Use a password manager to generate and store unique passwords for each account. Reusing passwords across sites is the single biggest multiplier of damage when any one of them gets breached.

Step 4: Recognize and Ignore Scam Emails

Once scammers have your address, expect an increase in phishing attempts. Recognizing the patterns reduces your risk significantly.

Red flags in suspicious emails:

• Urgent language ("Your account will be suspended in 24 hours")
• Mismatched sender addresses (the display name looks real, but the actual address is odd)
• Links that don't match the domain they claim to represent (hover before clicking)
• Requests for passwords, payment, or personal information via email
• Unexpected attachments

Legitimate companies will never ask for your password over email. When in doubt, navigate directly to the site rather than clicking a link.

Step 5: Consider Whether Your Address Needs to Be Replaced

This depends on the severity of the situation and how much spam or targeted phishing you're receiving.

Some people create a new primary email address and migrate their important accounts to it — particularly if the old address is being aggressively targeted or was deeply embedded in a breach. Others use email aliasing tools, which let you create disposable addresses that forward to your real inbox. This way, if an alias gets compromised or spammed heavily, you delete just that alias.

Others find that strong filtering, 2FA, and good password hygiene is enough to manage the situation without switching addresses.

The Variables That Determine Your Right Response

What the right next steps look like depends on several factors that vary from person to person:

• How widely was your email exposed? An address alone vs. an address combined with a password (or worse, security question answers) changes the urgency significantly
• How many accounts are tied to that email? Someone with dozens of linked services faces more exposure than someone with a handful
• What email provider are you using? Security features, 2FA options, and session management tools vary between Gmail, Outlook, Apple Mail, and others
• What's your current password hygiene? If you already use unique passwords and a password manager, the blast radius of exposure is much smaller
• Are you a higher-risk target? Journalists, executives, activists, or anyone with a public profile may face more sophisticated, targeted attacks than a typical spam campaign

Someone who reused the same password across 30 sites faces a completely different problem than someone running a password manager with 2FA already enabled. The core steps are the same — but the depth of remediation, and whether something more serious like identity monitoring makes sense, comes down to that individual picture.