Email inboxes are increasingly targeted by cybercriminals due to their central role in digital identity and access, according to cybersecurity researchers. Attackers leverage compromised email accounts to gain broader access to other online services, facilitate financial fraud, and launch more sophisticated attacks.
Access to an email account can provide attackers with the ability to reset passwords for various linked services, including banking, social media, and cloud storage. This access also allows them to intercept one-time passcodes and monitor communications. Attackers may also establish forwarding rules to maintain access even after a user attempts to secure their account, or exploit active sessions and connected applications to retain a foothold. The information gleaned from an inbox, such as account details, travel plans, and service subscriptions, can be used to craft highly convincing phishing emails for identity fraud or financial scams.
The threat of malicious emails is on the rise, with one cybersecurity firm reporting a 36% increase in detections during the second half of 2025 compared to the preceding six months. Phishing remains a primary attack vector, with 38% of cyberattacks in the past year attributed to it, followed by impersonation in emails at 12%. The human element plays a significant role in breaches, with social engineering accounting for 16% of all breaches. Mobile phishing simulations show a 40% higher click rate than email phishing.
Attackers are also employing more advanced tools, such as generative AI, to create phishing messages with flawless grammar and spelling, making them harder to detect. Business Email Compromise (BEC) schemes, which often originate from an inbox compromise, have resulted in substantial financial losses. Notable examples include an incident where Facebook and Google were defrauded of over $120 million through fake invoices, and a case where Crelan Bank lost over $75 million after an employee was tricked into wiring funds following the compromise of a high-level executive's email. Children's Healthcare of Atlanta was also targeted when fraudsters, impersonating a construction firm, sent a payment request after a building project was announced.
Protecting email inboxes requires a multi-faceted approach. For individual users, strong, unique passwords or passphrases, ideally managed with a reputable password manager or using passwordless methods like passkeys, are crucial. Multi-factor authentication (MFA) should be enabled on all accounts. Users should regularly review and update recovery options, ensuring old phone numbers or backup email addresses cannot be exploited. It is also advisable to periodically check email settings for unfamiliar forwarding rules, filters, or unrecognized connected devices. If a compromise is suspected, users should immediately change their password, revoke suspicious sessions, and review recovery details.
General security best practices include being vigilant against phishing attempts, treating unsolicited emails with caution, and verifying sender details by hovering over the sender name to check for mismatches or typos in domain names. Users should avoid clicking on links or opening attachments in suspicious emails and independently verify urgent requests with the sender through a separate channel. Employees should be particularly cautious with urgent wire transfer requests, even if they appear to come from senior executives or IT departments, and should verify such requests with a colleague or through an alternative communication method. Regular security awareness training for employees is also vital to educate them on the latest phishing tactics.
