I changed my password — is that enough?

Not always. A forwarding rule created during the intrusion survives a password change and keeps sending a copy of your mail. You also need to revoke active sessions and check the recovery address.

Why is email more sensitive than a bank account?

Because it lets you reset everything else, banking included. An attacker who controls the mailbox can request a reset on nearly every linked service and receive the links themselves.

Email account takeover

In plain terms

Someone gets into your inbox and creates a rule that forwards a copy of everything to them. Since email lets you reset all your other accounts, it opens up the rest.

Definition

Email account takeover is gaining control of a mailbox, which grants access not only to messages but also to resetting every account linked to it.

How it works

Access is gained through the usual paths: a reused password, phishing, or a transmitted code. What follows is subtler than the takeover itself: the attacker creates an automatic forwarding rule to an address they control, which gives them a permanent copy of the mail even after a password change. They then browse the history to identify linked banks, providers, and administrations, and use those services' "forgot password" function — whose reset emails arrive, by design, in the mailbox they control. Email is therefore the most sensitive account: it is the key to all the others.

Warning signs

A forwarding or filtering rule you didn't create
Messages marked as read that you never opened, or missing from the inbox
Reset emails received for services you never requested
Your contacts receiving messages you didn't send
The account's recovery address or phone number changed

How to verify

Open the mailbox's settings and check three things: forwarding and filtering rules, the recovery address and phone number, and the recent login history. An unknown forwarding rule is the clearest proof of an intrusion, and the one most often overlooked after a password change.

What to do

Treat your main mailbox as your most critical account: a unique password, two-factor authentication enabled, and periodic checks of forwarding rules.

If it already happened

Change the password from a clean device, remove any unknown forwarding rule, revoke sessions and connected third-party apps, then restore the recovery address and phone number. Then change the passwords of accounts linked to that address, starting with bank accounts. Warn your contacts, who will likely receive messages sent in your name.

Frequently asked questions

I changed my password — is that enough?: Not always. A forwarding rule created during the intrusion survives a password change and keeps sending a copy of your mail. You also need to revoke active sessions and check the recovery address.
Why is email more sensitive than a bank account?: Because it lets you reset everything else, banking included. An attacker who controls the mailbox can request a reset on nearly every linked service and receive the links themselves.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Credentials and accounts family. Last updated: 2026-08-31.