What Can Someone Do with Your Email Address without a Password?
Updated: Jul. 14, 2024
Your email can unlock crucial information for people with bad intentions. Here's what hackers could do if they got your email address.
Recently, I received a letter in the mail stating that my local hospital system’s online portal had a data breach. In other words, cybercriminals had hacked into it and accessed certain information stored in the system. The letter told me not to worry: The hackers didn’t get credit card info, dates of birth or Social Security numbers. The only thing they might have gotten is my email address. Despite the letter’s attempt to reduce my fear, I began to wonder: What can someone do with my email address without my password?
A lot, it turns out. Many people use a single email address in all areas of their lives, including for financial transactions, health and medical communications, social media, political causes, online shopping and more. So once hackers know your email address, they can use it for a wide range of nefarious purposes, like phishing for even more sensitive information, impersonating you, stealing your identity and ultimately causing serious damage to your personal and financial life.
To help you best protect yourself, Reader’s Digest spoke with Alex Hamerstone, advisory solutions director at cybersecurity firm TrustedSec, and Greg Kelley, chief technology officer at the digital forensics company Vestige Digital Investigations. Ahead, you’ll learn more about what someone can do with your email address and how to use the experts’ top tech tips to stop them.
Get Reader’s Digest’s Read Up newsletter for more tech, travel, humor and fun facts all week long.
What can someone do with my email address without a password?
Once a hacker knows your email address, your personal and financial information—as well as that of your friends, family members and other contacts—could be at risk. “Your email address can often be used to associate you with multiple accounts and services and, in many cases, can provide other information about you, such as where you work,” says Hamerstone.
Hackers may even discover where you do your banking and what social media accounts you have, among other private details. “It really depends on how long you have had your email address, how often you share it and how many different sites you use the same address [on],” he says.
If you aren’t vigilant, you could end up providing hackers with additional information that helps them cause even more damage. Yikes! So keep reading for the top nine things someone can do with your email address—without even knowing your password.
Send phishing emails
Ask any cybersecurity expert, “What can someone do with my email address without a password?” and they’ll likely say, “Go phishing.” This isn’t a reference to seafood—it has to do with scams.
“The biggest risk to someone having your email address,” Hamerstone says, “is that they can use it for phishing attacks.
How it works
Hackers send messages to your email address that look like they’re from legitimate companies and “try to convince you to take action, whether that action is to give them money, access to your accounts or personal information that they can use to steal your identity,” he says.
Often, they tell you there’s some problem with your account, making it sound urgent. They provide a link for you to log in to a website (that’s really fake) to fix it. When you log in with your email and password, the scammers steal your credentials. “These types of emails are very common,” says Kelley. “People fall for these emails because the emails are carefully crafted, using icons and wording copied from legitimate emails.”
Phishing attacks are often the starting point for more sophisticated cybercrimes.
“When a hacker knows your email address, they have half of your confidential information. All they need now is the password,” Kelley warns. If they have that, scammers could access your email account too, and that’s when the serious damage starts.
How to avoid it
To block phishing emails, Hamerstone recommends setting up multifactor authentication. “That way, even if a hacker has your email address and password, they will still be prevented from accessing your account, in most cases,” when they try to sign on from an unrecognized device. That’s because they’ll need the secret code that is sent to your device after a log-in attempt.
Be sure to use strong, unique passwords too. If you use the same password on multiple sites, hackers have to do a lot less work to access your accounts. And of course, never divulge your email password.
You can also download anti-phishing browser extensions or apps to protect against phishing attacks. And be suspicious of any email that asks you to click a link to sign in. You can always go to the website directly or call the company to find out if the message is legitimate.
Spoof an email address
In addition to sending scam emails to your account, attackers can spoof an email address—maybe even yours—to scam other people too.
How it works
First, someone forges a sender address that looks a lot like a legitimate one, making only small and tough-to-spot changes, like adding a period or swapping a number with a letter. Then, using that spoofed address, they send email messages containing harmful malware or requests for money or personal information.
Hackers often spoof the email addresses of big companies like Amazon. But if their phishing email got you to divulge the password to your email, attackers could access your contacts and make your friends and family think an email (containing a malicious link) is coming from you.
They’re easy enough to fall for. “People get a large quantity of email and don’t necessarily know how to identify if an email is spoofed,” Hamerstone says.
How to avoid it
Hamerstone says email providers have gotten much better at identifying and blocking spoofed emails in their spam filters. Still, it’s a good idea to know what to look for. One easy check is to hover over the sender’s name (without clicking) until the sending address is shown. If it doesn’t match the displayed name, it’s likely a spoof.
Also check for tiny differences in spelling or punctuation in the sender’s name and email address (think: Amaz0n versus Amazon). And if the email is purportedly from someone you know, make sure it’s the same address they usually use when they communicate with you.
Stalk you
When someone has just your email address, it can still have dangerous, real-world consequences should someone want to stalk you.
How it works
“Your identity is pretty easy to tie back to your email address,” Hamerstone says, “especially if you have an uncommon name.” People often use their email addresses for services, forums and the like, and they include their real name and physical address along with it. Or worse, they use some version of their real name as their email address or username.
In addition, people often include their email address on Facebook, LinkedIn and other social media sites. Unless you have privacy protections in place, people who know your email address may be able to find pictures of you, as well as information like where you work, who your colleagues are and where you went to school.
People can also use an online “reverse email lookup” tool, which will tell them the real name associated with that email address and possibly other information, like your physical address and phone number.
These tools vary widely in their accuracy, Hamerstone says. “These can run from paid services—with accurate and vetted databases that are sold to businesses and others—to other sites that just scrape the internet looking to associate names with email addresses,” he adds. “The amount of additional information these sites can provide really depends on how you use your email address. If you sign up for things with your email address and physical address, those things can be associated.”
How to avoid it
It’s smart to have different email addresses for different purposes. You could have one that you use only with personal friends and family members, one for online shopping, one for banking and so on. That way, your online profile doesn’t automatically lead to your true identity.
“If it’s your first and last name, then it is much easier, obviously, to tie back to you than if it is something random or several nouns,” Hamerstone says. In addition, if one of your email addresses gets compromised, at least the damage is limited to that one. Hamerstone adds that Apple and other companies offer one-time-use email addresses that you can use to sign up for things, instead of using your real email address.
It also makes sense to lock down the security settings on your social media accounts as much as possible.
Expose personal information about you
Another thing someone can do with your email address without your password: blackmail or dox you. What is doxxing? An attack in which someone reveals personal information that you had hoped to keep anonymous.
How it works
Let’s say you make comments online under the username “sportsfan123.” If someone wants to expose or blackmail you, Hamerstone says, all they need to do is search for that username on other sites until they find a post with enough personal information to figure out who you are. Then they can post your home address, phone number or potentially embarrassing info online.
How to avoid it
Don’t reuse the same username across multiple sites, and avoid including any personally identifying information with such posts.
Sign you up for unwanted subscriptions or services
If you’re old enough, you may remember the days when “friends” would sign up for a monthly music CD subscription using your name and address. You’d then be on the hook for payment, not to mention the monthly annoyance of receiving music you didn’t want or like. Today, hackers can use your email address for much the same kind of online scam.
How it works
Once someone has your email address, they can sign you up for anything from free dating apps to spammy newsletters. They probably can’t do a lot of damage, financially or otherwise, Hamerstone says, because most of these will require the user to confirm the email address. However, the annoyance factor is high, and some people have reported receiving thousands of such sign-ups.
How to avoid it
Be selective about where and to whom you give your email address. Freely sharing it can cause it to fall into the wrong hands. And again, avoid using the same email address for every type of communication or transaction.
Access your online accounts
Attackers can’t access your online accounts with just your email address—at least not without stealing your password first. Unfortunately, phishing scams help hackers get your password, and once they have that, they can do considerably more damage.
Once they’re able to log in to your email account, they can learn the passwords to any online accounts that use your email address as the username.
How it works
To learn the password to any account, they start by attempting to log in to the account. They enter your email address in the username field, click the “forgot password” button and change the password using the email sent to your address. At that point, they could even change the email address associated with your online accounts.
How to avoid it
Avoid using your email address as your username whenever possible, Hamerstone advises. He also emphasizes the importance of setting up two-factor authentication (2FA) for your online accounts. “If users are using multifactor authentication, scammers would need a way around that as well,” he says. It can also be helpful to have strong, unique passwords for every account, so they’re much more difficult to guess or replicate.
Steal financial information—or money
Your financial information is just a hop, skip and jump away from your email address.
How it works
If hackers know your email address, they can phish for your password. With your password, they can target your online bank accounts, especially if you have connected them to the email address that was hacked. As with any other online account, they can reset the account information. And that means they could start having money transferred to their accounts instead of yours.
How to avoid it
Don’t reuse passwords on multiple sites, don’t use your email address as your username and do enable multifactor authentication. It may sound like familiar advice by now, but experts repeat it for a reason. It helps keep your online information secure.
Steal your identity
Here’s a bit of good news: “Identity theft is challenging with just an email address,” Hamerstone says. The risk increases, however, when scammers have your password as well.
How it works
If hackers are able to log in to your email account and dig through your inbox, it’s possible for them to learn enough about you to steal your identity. Your email could contain materials like bank documents or employment records, which have several pieces of information—like your Social Security number and credit card numbers—needed to commit identity theft.
How to avoid it
Sign up for a dark-web-monitoring service, such as Identity Guard. Many of these are free and will alert you if your information was included in a data breach or is being sold online. Also keep an eye on your bank and credit card statements for any transactions you didn’t make. If you see something, take action immediately.
Find out when you’ll be out of town
Many of us know not to post information about upcoming travels on social media, but a hacker could use your email address to get this info too.
How it works
If scammers find the password to your email account, they can access any message you may have saved about upcoming travel, such as flight or hotel reservations. They can then use that information to target your physical address while you’re away.
How to avoid it
At the risk of repeating ourselves, some of the same advice as above stands: Use a separate email account for travel-related correspondence. Minimize the risk of someone finding out your password by using strong, unique passwords for each site. And always use multifactor authentication.
FAQs
How can hackers get your email address?
Data breaches, like the one I experienced, are one way bad actors get your email address. But sometimes they find them fair and square. After all, some people make their email visible on social media accounts such as LinkedIn, Facebook and Instagram (it’s best practice not to do this).
“Email addresses are often more or less public,” says Hamerstone. “Some people have had the same email address for decades and have used it to sign up for countless services over the years.”
It could be tied to banking transactions, health care accounts, social media, online shopping, political donations and more. Some of these services and companies sell email addresses in large marketing lists. “As one can imagine,” he says, “these oftentimes find their way into the wrong hands.”
Is it safe to give out your email address?
Yes. It would be impossible to keep your email address completely secret, given how many things we do today that require us to share our email addresses.
That said, you should be selective about where and to whom you give your email address. Freely sharing your email can cause it to fall into the wrong hands, and you might end up being flooded with annoying marketing emails—or becoming a victim of a hacker, who can use it to carry out a wide range of harmful activities.
Another option, Hamerstone says, is to use a feature like Hide My Email, which Apple offers to iCloud+ subscribers. It masks your true email with a unique, randomly generated address when you fill out forms or create accounts online. He says other companies offer similar features.
What can hackers learn from just an email address?
Once hackers know your email address, they may be able to figure out your name, location, job, username on social media and other online accounts, where you went to school and possibly the names of your friends and relatives. That’s why “What can someone do with my email address without a password?” is a pretty important question. Though scammers can do worse damage when they have your password, they can still cause issues with an email alone. And let’s not forget that your email may lead them to your password.
How can you stay safe from hackers?
Hamerstone recommends giving out your main email address as infrequently as possible. Instead, set up several free email accounts that you can share with online retailers or other less-trusted sources, he says.
You should also prioritize using a strong, unique password for your email account. And change that password every couple of months. For all other sites or apps, remember to use a different password for each one (store them in a password manager if you’re worried about forgetting them), or use a service that hides your true email. Also remember to secure your email account with 2FA.
How can you tell if a scammer has your email address?
If a scammer has your email address, you might notice any of the following:
- A sudden surge of phishing emails
- A request for a 2FA code when you weren’t logging in to a website
- An inability to log in to a website because a hacker put in the wrong credentials too many times
- A security alert
- Emails sent to your contacts when you didn’t send them
You can also go to HaveIBeenPwned.com. You can enter your email address there to see if it’s been compromised.
What should you do if you think you’ve been hacked?
If you believe you’ve been hacked, you’ll need to take action immediately to minimize the damage. Here’s what to do if a scammer has your email address:
- Try to log in to your email. If you can’t (because the hacker has changed the password), tell your contacts that you’ve been hacked so they know to mark that email address as “spam” and ignore anything coming from it. Then create a new email account and share it with friends and family.
- If you can log in to your email, change your password. Be sure to use a password you’ve never used before.
- Go to your account settings and sign out any and all devices. This will boot out any hackers who may be logged in.
- Run antivirus and/or anti-malware software to identify and remove any malicious programs the hacker may have installed. Make sure your operating system and browser are updated to the latest version (which will contain all the latest security patches).
- Freeze your credit through all three major credit bureaus’ self-service portals until you know what, if any, financial damage has been done.
- Get serious about security: Update all your passwords and security questions for your online accounts, and activate 2FA whenever possible.
Additional reporting by Brooke Nelson Alexander.
About the experts
|
Why trust us
Reader’s Digest has published hundreds of articles on personal technology, arming readers with the knowledge to protect themselves against cybersecurity threats and internet scams as well as revealing the best tips, tricks and shortcuts for computers, cellphones, apps, texting, social media and more. For this piece, Laurie Budgar tapped her experience as a longtime reporter who’s written about technology. Then Chuck Brooks, a globally recognized expert on cybersecurity and emerging technologies, Georgetown University professor and thought leader who has briefed the G20 on cybersecurity and received two presidential appointments, gave it a rigorous review to ensure that all information is accurate and offers the best possible advice to readers. We rely on credentialed experts with personal experience and know-how as well as primary sources including tech companies, professional organizations and academic institutions. We verify all facts and data and revisit them over time to ensure they remain accurate and up to date. Read more about our team, our contributors and our editorial policies.
Sources:
- Alex Hamerstone, director of advisory solutions at TrustedSec; interview May 2022 and May 2024
- Greg Kelley, chief technology officer of Vestige Digital Investigations; interview May 2022 and May 2024
- Apple: “Create unique, random email addresses with Hide My Email and iCloud+”
Originally Published: June 13, 2024
