Email Account Takeover: How It Happens and How to Stop It

Email Account Takeover: How It Happens and How to Stop It

Email Account Takeover: How It Happens and How to Stop It

Business owner signing in to email

Email account takeover happens when someone other than you logs in to your mailbox, usually with a password they phished, bought or guessed from an old breach. From there they can read your mail, reset your other accounts and impersonate you to your clients. You can stop most of it with three habits: a unique passphrase for every account, multi-factor authentication (MFA), and a second-channel check before you act on any request involving money or codes. This guide covers how attackers get in, the signs to watch for, what to do in the first hour, and the steps Canadian businesses should take.

TL;DR

  • Attackers get into mailboxes through phishing, reused passwords from breach dumps, purchased credentials and tricking you into reading out a one-time code.
  • Once inside, they often stay quiet and watch your mail before they strike, and they may hide their tracks with mailbox rules.
  • Prevent it with a unique passphrase per account, a password manager, MFA (phishing-resistant where possible) and call-back checks on payment requests.
  • If it happens: change your password, fix recovery details, check connected apps, warn contacts, tell your bank if money is involved and report it.
  • Businesses in Canada may also have PIPEDA breach reporting duties.

Table of Contents

What email account takeover actually is

An email account takeover is a break-in where the attacker uses a real login rather than breaking software. They sign in as you. That is what makes it hard to spot: the provider sees a valid username and password, and your contacts see a message from an address they trust.

Email is the prize because it is the master key. Password-reset links for your bank, your cloud storage and your social media all land in your inbox. Whoever controls the mailbox can often take over everything else.

It is also worth separating this from spoofing. In spoofing, an attacker fakes the “from” line of a message without ever entering your mailbox. In a takeover, they hold the real account. The defences overlap, but the damage from a takeover is usually larger because the attacker sees your history, your contacts and your habits.

What email account takeover actually is

How attackers get into an email account

The techniques are well documented. The MITRE ATT&CK framework lists the ways adversaries compromise email accounts: phishing, buying credentials, brute-forcing with passwords reused from breach dumps, and even paying employees, suppliers or business partners for access.

Phishing and fake login pages

The classic route is a message that urges you to sign in through a link. The page looks like your provider’s, but it belongs to the attacker. Newer versions go further. The Canadian Centre for Cyber Security explains that adversary-in-the-middle phishing can intercept your username, password, MFA secrets and session tokens when you follow a link to a fraudulent login site. In other words, some MFA methods can be relayed in real time, which is why the Cyber Centre points to phishing-resistant MFA.

Reused passwords and credential stuffing

When any site you use is breached, the leaked email and password pairs are tested against other services. If you used the same password on a shopping site and on your mailbox, the attacker does not need to trick you at all. This is the single most preventable cause of takeover.

Tricking you into sharing a code

The Canadian Anti-Fraud Centre warns that fraudsters may trigger a genuine one-time code, pose as a company or security representative, and persuade you to read the code out. With it they can change the password and take control. A real provider will never phone you and ask for a code that was sent to you.

Insiders and third parties

For businesses, access can also leak through a supplier, a former employee or a partner whose own account is weak. This is one reason shared passwords and old accounts are a liability.

What attackers do once they are in

Many victims expect an immediate lockout. More often the opposite happens. FINRA notes that attackers may monitor a mailbox for weeks or months to learn transaction procedures, client communications and the best moment to act. They then request fraudulent transfers, install malware or forward client information. They may hide it by changing mailbox rules.

The FBI’s Internet Crime Complaint Center describes the same pattern: compromised business mailboxes are used to study financial communications, create forwarding or deletion rules, impersonate businesses, redirect payments and target the contacts in the address book.

In practice, that means a takeover can produce:

  • A fake invoice sent to your clients with new bank details.
  • Password resets on your other accounts, with the reset emails deleted so you never see them.
  • A copy of every new message quietly forwarded to an outside address.
  • Phishing sent from your address to everyone you know, which is far more convincing than a message from a stranger.

Signs someone is in your email

The Canadian Anti-Fraud Centre lists signs worth checking:

  • One-time codes or password resets you did not request.
  • Someone asking you for a code that was just sent to you.
  • Login or account-activity notifications from places or devices you do not recognize.
  • Being locked out of your own account.
  • Messages or transactions you did not make.
  • Friends or family telling you they received odd messages from you.

For businesses, the RCMP describes business email compromise warning signs: urgent or secret payment requests, deviations from normal procedures, slightly altered sender addresses, requests for login or tax information, unexpected supplier payments, and suspicious attachments or links.

Two checks take five minutes and are worth doing now:

  1. Look at your mailbox rules and forwarding settings. Any rule you did not create, especially one that forwards, deletes or moves mail to an obscure folder, is a red flag.
  2. Review recent sign-in activity and connected apps or devices. Remove anything you do not recognize.

How to prevent email account hacking

The Cyber Centre’s email security best practices give a clear baseline. Here is how it translates for individuals and for organizations.

For individuals and sole proprietors

  1. Use a unique, strong passphrase for every account. Long and memorable beats short and complex. Never reuse your email password anywhere else.
  2. Use a password manager. It makes unique passphrases realistic, and it will not autofill on a lookalike site, which is a small but useful phishing check.
  3. Turn on MFA. The Cyber Centre describes MFA as an extra access-control layer that helps block unauthorized access even when a password has been compromised. Where your provider offers a phishing-resistant method, such as a hardware security key or passkey, prefer it over codes sent by text.
  4. Never read out a code. If someone calls, messages or emails you about a code, hang up and contact the company through its official website or the number on your card.
  5. Verify sensitive requests independently. If a message asks for money, gift cards or credentials, confirm by phone with a number you already had.

For Canadian businesses

The Cyber Centre and the RCMP both recommend layers, because no single control covers everything:

  • Staff training. Teach people what urgency, secrecy and slightly altered sender addresses look like.
  • Patching. Keep devices and software current.
  • Domain anti-spoofing controls. SPF, DKIM and DMARC make it harder for outsiders to send mail that pretends to be from your domain.
  • External-email warnings so staff notice when a “colleague” message came from outside.
  • Payment call-backs. The RCMP advises verifying payment requests through another method, such as a phone call, because these schemes exploit trust, urgency and secrecy. Pair it with dual approval for high-risk transfers.
  • Least privilege and separate admin accounts. The Cyber Centre’s guidance on administrative privileges recommends admin accounts that cannot read email or browse the internet, along with strong authentication, MFA, unique credentials, logging and two-person approval for critical actions. Separating admin work from everyday mail limits the damage when an ordinary mailbox is compromised.
  • Logging and a tested incident plan, so you know who does what in the first hour.
  • Limit public information. The RCMP also advises limiting what you publish about staff and procedures, since attackers use it to make requests believable.

A quick comparison

Control Stops reused-password attacks Stops phishing Limits damage after a breach
Unique passphrases and a password manager Yes Partly (no autofill on fake sites) No
MFA Yes Partly; phishing-resistant MFA is strongest Partly
Payment call-backs and dual approval No Yes, for payment fraud Yes
Separate admin accounts, least privilege No No Yes
DKIM/DMARC on your domain No Reduces spoofing of your domain Reduces impersonation

Why your email setup matters

The habits above matter most, but the platform under your mailbox also shapes your risk. Spam and malware filtering reduces how many phishing messages reach you. Properly aligned DKIM and DMARC make it harder for criminals to impersonate your domain to your clients. And the practical question of where your mail is stored and who can reach it is one that Canadian businesses and professionals increasingly ask, especially under PIPEDA.

Our perspective

Most takeover stories we hear start the same way: a mailbox on a domain that nobody really owns the settings for. The business has a free address or a mailbox tied to a big platform account, the password is shared or reused, and nobody has looked at the forwarding rules in years.

We think the fix starts with ownership. When you use your own domain for email, you decide who has a mailbox, you can remove a departed employee in one step, and your clients learn to trust one address that is yours rather than a generic one. We build Tinymail around that idea: custom domain email hosted in Canada, with spam and malware protection, DKIM/DMARC alignment and straightforward annual pricing, so a small team does not need an IT department to get the basics right.

Hosting in Canada also matters for the privacy conversation that follows a breach. Knowing exactly where your mail lives, and that it stays under Canadian law, makes your PIPEDA obligations easier to reason about and to explain to a client.

No provider can replace good habits. A unique passphrase and a phone call before paying a changed invoice are still the best defences you have. We design our service to give those habits a sound foundation.

Aaron Manfred

What to do right away if your email was taken over

Speed matters. The Cyber Centre’s guidance on managing an account compromise and its business guidance on managing email point to the same sequence.

  1. Contact your IT security officer if you work for an organization. If you are on your own, contact your email provider and report the compromise.
  2. Change your password to a strong, unique passphrase, from a device you trust. If you can, sign out all other sessions.
  3. Correct recovery details. Attackers often change the recovery email address or phone number so they can come back.
  4. Check forwarding, filters and connected apps and devices. Remove anything you did not set up. The Cyber Centre’s incident guidance also recommends revoking third-party app access and reviewing privileges.
  5. Change reused passwords everywhere else you used the same one, starting with banking and any account that sends resets to this mailbox.
  6. Scan your devices for malware. The password may have been taken by software on your computer, in which case changing it alone will not help.
  7. Alert your contacts so they ignore suspicious messages sent in your name, and especially any change to payment details.
  8. Contact your bank and credit-card providers immediately if money or financial information may have moved.
  9. Report it. See below.

For organizations, the Cyber Centre adds one point that is easy to miss: contact your email platform, because other accounts on the same server may also be compromised. Treat a single hijacked mailbox as a possible sign of something wider until you have checked.

The Cyber Centre’s page for victims of cybercrime recommends reporting to your local police, to the Canadian Anti-Fraud Centre (1-888-495-8501 or its online reporting system) and to the Cyber Centre. It also advises telling your bank and credit-card providers and asking Canada’s main credit-reporting agencies for a fraud alert.

If you run a business that holds personal information, there is a legal layer. Under PIPEDA, private-sector organizations must report breaches that create a real risk of significant harm to the Privacy Commissioner, notify affected individuals and keep breach records, as the Cyber Centre’s compromise guidance summarizes. The Office of the Privacy Commissioner explains that a report must describe the breach and its cause if known, the timing, the information involved, the number of people affected, the steps taken to reduce harm, the planned notification and a contact person. See its mandatory breach reporting guidance for the details. If you are unsure whether a mailbox incident meets the threshold, speak to legal counsel early, since the same Cyber Centre guidance suggests involving legal and financial counsel where necessary.

Moving to a Canadian-hosted mailbox

Moving to a Canadian-hosted mailbox

If you are reading this because an incident has made you rethink your setup, a clean start can be a good moment to move. Migration is easier than most people expect: you keep your domain, create the mailboxes at the new provider, point your domain’s mail records to it, and import your old mail over IMAP. Use the move to retire old accounts, give each person their own mailbox with a unique passphrase, and publish DKIM and DMARC records for your domain.

Tinymail offers Canadian-hosted email on your own domain, with an integrated calendar and contacts, spam and malware protection, DKIM/DMARC alignment, IMAP/SMTP sync and webmail. Our plans are billed yearly:

Plan Price
Solo $19.99 CAD per year
Startup $39.99 CAD per year
Business $59.99 CAD per year
Business Plus $99.99 CAD per year
Team $179.99 CAD per year

Plans differ by mailbox count and storage. See the plans on the Tinymail site for what each includes.

Promo: email on your own domain, hosted in Canada

If you want a mailbox you control, on a domain you own, with all customer email data hosted in Canada, Tinymail’s yearly plans start at $19.99 CAD per year for Solo and scale to teams with the Team plan at $179.99 CAD per year. There are no monthly fees to track.

Tinymail

Choose the plan that matches your mailbox count, add your domain, and pair it with the habits in this guide. You can start from the Tinymail home page.

FAQ

What happens when your email is compromised?

The attacker can read your messages, reset your other accounts and send mail as you. Many stay hidden for weeks or months, watching how you handle payments and clients, and they may create forwarding or deletion rules to cover their tracks. Check your rules, sign-in history and connected apps as soon as you suspect a problem.

Can you tell if someone is accessing your email?

Often, yes. Look for password-reset emails or codes you did not request, unfamiliar sign-in alerts, being locked out, sent messages you did not write, and contacts mentioning strange emails from you. Also look for mailbox rules or forwarding addresses you did not create.

How can I stop my email from being hacked?

Use a unique strong passphrase, store it in a password manager, and turn on MFA, preferring phishing-resistant methods where offered. Never share a one-time code with anyone who contacts you. Confirm any payment or credential request through a second channel, such as a call to a number you already have.

Is MFA enough to prevent account takeover?

MFA greatly helps when a password has leaked, but it is not a complete answer. The Cyber Centre warns that adversary-in-the-middle phishing can capture MFA secrets and tokens, so combine MFA with caution about links, and use phishing-resistant MFA where you can.

Do I have to report an email takeover in Canada?

Individuals can report to police, the Canadian Anti-Fraud Centre and the Cyber Centre. A private-sector organization must report to the Privacy Commissioner when personal information is involved and there is a real risk of significant harm. Ask legal counsel if you are unsure.

Sources

Made with BabyLoveGrowth to grow your link profile

This article is provided for general informational purposes only and does not constitute professional advice.