Roger Irwin Computer Services - IT Support Services - Computer Repair - Nelson / Richmond / Tasman
Book an Appointment 03 548-2220

Secure Your Email Account Against Phishing

Your email account is the key to everything else: every other password can be reset through it. Most phishing is aimed at getting into it. These steps make a stolen password much less useful, and help you spot it quickly if someone does get in.

Turn on two-factor authentication

With two-factor authentication (2FA), signing in needs your password and something only you have, usually your phone. It stops the vast majority of account takeovers.

  • Microsoft 365 and Outlook.com Go to mysignins.microsoft.com/security-info and add the Microsoft Authenticator app.
  • Gmail and Google Workspace Go to Manage your Google Account, then Security, and turn on 2-Step Verification.
  • Choose an app or passkey over text messages An authenticator app or a passkey is harder to steal than a code sent by text.

Use a passkey if you can

A passkey signs you in with your fingerprint, face or phone PIN instead of a password. Microsoft and Google both support them. A passkey only works on the real website, so a fake login page can't steal it, which makes it the best protection against phishing there is.

Don't approve sign-ins you didn't start

If your phone suddenly asks you to approve a sign-in, or keeps asking over and over, someone else has your password and is hoping you'll tap Approve to make it stop.

Deny it, then change your password straight away. Microsoft Authenticator asks you to type a number shown on the sign-in screen. If you can't see a sign-in screen, there's no number to type, and that's your answer.

Check for rules and forwarding

After getting in, scammers often add a rule that forwards your email to them, or hides replies from your contacts, so they can keep watching after you change your password. Check every so often, and always after a scare.

  • Outlook Open Settings, then Mail, and look at Rules and Forwarding. Delete anything you don't recognise, especially rules that move messages to RSS Feeds, Archive or Deleted Items, or mark them as read.
  • Gmail Open Settings, then See all settings, and check Filters and Blocked Addresses and Forwarding and POP/IMAP.

Look at recent sign-ins

  • Microsoft mysignins.microsoft.com shows recent sign-ins and where they came from.
  • Google Manage your Google Account, then Security, shows recent security activity and the devices signed in.

Sign-ins from another country, or from a device you don't own, mean someone else has your password. Change it, sign out everywhere, and see what to do next.

For businesses

If you use Microsoft 365 or Google Workspace, two-factor authentication can be required for every staff member, sign-ins from overseas can be blocked, and alerts can be set up for new forwarding rules. We set this up for Nelson businesses and can check your current settings. Call us on 03 548-2220.