Spam is annoying. Phishing is dangerous. The two usually arrive through the same door: your email address ending up in places you never intended. Once an address is on a spam list or in a breached database, it gets reused for years, so the best mailbox security starts before the first unwanted message ever arrives.
This guide walks through the steps I recommend, in order of impact: limiting where your address goes, locking down the account itself, tuning your filters, recognizing phishing, and knowing exactly what to do if something gets through.
How spammers and phishers get your address
- Sign-up forms: newsletters, contests, downloads and coupon sites that share or sell their lists.
- Data breaches: leaked customer databases that are traded and reused long after the breach.
- Scraping: addresses posted publicly on websites, forums and social profiles.
- Guessing: common patterns like firstname.lastname at popular providers.
You can't control breaches or guessing, but you can control the first item, and it's the biggest source for most people.
Step 1: Limit where your real address goes
Every site that has your real address is a site that can leak it. Keep your main address for people and services you trust, and use something else everywhere else:
- Temporary email for one-time sign-ups. For downloads, coupons, Wi-Fi portals or sites you're just testing, a disposable address from Temp Mail .FYI receives the confirmation and then expires. Anything sent to it afterwards, including spam and phishing, never reaches you.
- Aliases for accounts you'll keep. Shopping sites and subscriptions get their own forwarding alias, so if one starts receiving spam you know who leaked it and can switch that alias off.
- Your real address for what matters: banking, work, healthcare, government and personal contacts.
For a deeper look at when each option fits, see How to Leverage Temp Mail Services to Protect Your Privacy.
Step 2: Lock down the account itself
Filtering spam doesn't help much if an attacker can sign in to your mailbox. These settings matter more than any filter:
- A unique, strong password. Use a password manager so every account has a different password. Reused passwords are how one breach turns into many.
- Two-factor authentication. Turn it on, and prefer an authenticator app or a passkey over SMS codes, which can be intercepted through SIM-swap fraud.
- Recovery options you still control. Check that the recovery phone number and backup email are current. An old recovery address is a quiet way in for an attacker.
- Forwarding rules and filters. This is the one most people never check. A common move after a mailbox is compromised is to add a hidden rule that forwards or deletes certain messages. Review your forwarding settings and filters a few times a year.
- Connected apps and active sessions. Remove apps you no longer use, and sign out sessions you don't recognize.
Step 3: Make your filters work for you
Gmail, Outlook and most other providers already filter aggressively, and you can make them better:
- Use "Report spam" or "Report phishing" instead of just deleting. Reporting trains the filter for you and helps protect other users too.
- Block repeat senders who ignore unsubscribe requests.
- Check the spam folder occasionally for legitimate mail, and mark it "not spam" so the filter learns.
- Create rules that send newsletters to a separate folder, so real messages and urgent-looking scams don't get mixed together.
Step 4: Recognize phishing before you click
Phishing works by creating urgency and borrowing trust. Slow down and check these before acting on any message that asks you to sign in, pay or download something:
- The real sender address, not just the display name. "PayPal Support" can be sent from any address.
- Lookalike domains. One extra letter, a swapped letter or a different ending (paypa1.com, micros0ft-support.net) is a classic trick.
- The real link destination. Hover over a link (or long-press on mobile) to see where it actually goes.
- A mismatched Reply-To address that sends your answer somewhere else.
- Pressure and threats: "your account will be closed today", "payment failed", "unusual sign-in".
- Unexpected attachments, especially ZIP, HTML, ISO or macro-enabled Office files.
When in doubt, don't use the link. Open the website by typing its address yourself, or use the official app. For more examples, read How to Spot a Phishing Email Before It Steals Your Data.
Step 5: Be careful with unsubscribe links
For newsletters you actually signed up for from reputable companies, unsubscribing is the right move and usually works. For obvious spam from senders you've never heard of, don't click "unsubscribe": it can confirm your address is active, and the link itself may be malicious. Report it as spam instead.
Step 6: If you clicked a phishing link
It happens to careful people too. Act quickly, in this order:
- Change your password from a trusted device, and change it on any other site where you used the same one.
- Sign out all other sessions from your account's security settings.
- Check forwarding rules, filters and recovery details for anything you didn't set up.
- Turn on two-factor authentication if it wasn't already on.
- Run a security scan if you downloaded or opened an attachment.
- Watch your bank and important accounts, and contact your bank right away if you entered payment details.
Mailbox security checklist
| Area | What to do |
|---|---|
| Exposure | Temp mail for one-time sign-ups, aliases for kept accounts |
| Password | Unique and stored in a password manager |
| Two-factor | Authenticator app or passkey, not just SMS |
| Recovery | Current phone number and backup email |
| Rules | Review forwarding and filters a few times a year |
| Filters | Report spam and phishing instead of only deleting |
| Habits | Check sender and links; type addresses yourself |
Frequently asked questions
Why am I suddenly getting so much spam?
Usually because your address appeared in a new breach or was shared by a site you signed up to. Check whether it was leaked, then tighten where you use it going forward.
Can I stop spam completely?
Not completely, but limiting where your real address goes, reporting spam and using filters will reduce it to a trickle.
Does temp mail protect me from phishing?
It keeps phishing aimed at low-trust sites away from your real inbox. It doesn't replace the habits above for the messages that do reach you.
The bottom line
A secure mailbox comes from a few habits working together: share your real address sparingly, protect the account with a unique password and two-factor authentication, let your filters learn, and pause before you click. Start with the step you're missing, and work through the rest over the next week.
