Inside the inbox: Why cybercriminals want to break into your email account

Email is not just a means of communication, or yet another online account. In both our personal and work lives, it holds the keys to the kingdom: possibly even a mechanism to reset other account passwords and verify your identity. Email accounts are also the place where password-reset links arrive, account alerts are stored, bookings are confirmed, invoices are filed and identity checks begin.

The inbox may, therefore, contain years’ worth of detailed information about you, including what you own, which services you use, where you go, who you trust and how other accounts can be reached.

That’s why it’s also a prized target for cybercriminals.. If you want to protect your personal or business accounts and data, security must start with your inbox.

Attackers have your inbox in their sights because it can give them leverage over the rest of your digital life. With access to your email account, they can reset your passwords across multiple other accounts – perhaps intercepting one-time passcodes sent by your bank, social media, cloud storage or other online provider.

They may also try to stay hidden, setting up automatic forwarding rules so they can keep receiving your messages even after you think the immediate problem has been fixed. In other words, even if you perform a password reset, they’ll get sent the reset codes. Others may abuse access tokens, connected apps or active sessions to retain a foothold.

Hackers could access your photos for potential blackmail, and eavesdrop on your communications. That could lay the groundwork for a convincing phishing email designed to impersonate a trusted organization you interact with. It might ask for money, fee payments, or more personal information with which to carry out identity fraud. The more information (e.g., account details) they have on you, the more convincing the phishing attack will be.