Online Security 101: Emails

Our Online Security series explores important cybersecurity topics that are often overlooked but become increasingly important as more of our lives move online.

Part 1 focuses on one of the most fundamental pieces of our digital identity: email.

Almost everyone has at least one email address, but few people spend much time thinking about how to organize and manage their email accounts to reduce cybersecurity risks. By the end of this article, you’ll understand how to organize your email accounts to:

• Reduce spam
• Lower the likelihood of fraud
• Strengthen account recovery
• Keep your email setup simple and easy to manage

How Many Email Accounts Should I Have?

While most people have one email for work and another for personal use, having a few additional addresses can dramatically reduce spam and improve security.

Before discussing how many accounts to create, it’s worth knowing one of Gmail’s most useful features:

Any email sent to username+anything@gmail.com is automatically delivered to username@gmail.com.

This allows you to create virtually unlimited email aliases without creating additional Gmail accounts.

There are two common ways to organize these aliases.

Option 1: One Public Email Per Service

Some people create a unique email alias for every website they sign up for. This makes it easy to identify which company leaked or sold your email address.

For example:

• public_username+amazon@gmail.com
• public_username+netflix@gmail.com
• public_username+bank@gmail.com

It’s still helpful to maintain at least two primary accounts:

• public_username@gmail.com
• private_username_dontshare@gmail.com

If you use multiple email providers, you can forward everything to a single Sink Account that collects all incoming mail in one inbox.

Option 2: One Public Email Per Category

A simpler approach is to organize aliases by category instead of individual service.

For example:

Financial

Use an address dedicated to banks, brokerages, investment platforms, and other financial institutions.

Financial companies are generally subject to stricter regulations and tend to be better custodians of personal information than many consumer apps.

Health

Reserve an address for doctors, hospitals, pharmacies, insurance providers, and other healthcare services.

E-commerce

Use an address for online stores and services that may store payment information.

Whenever possible, paying through services like PayPal can further reduce your exposure if a merchant experiences a breach.

Personal

Give this address only to friends and family.

Social Media

Social media accounts deserve their own address because they often contain sensitive personal information and are increasingly connected to commerce.

Throwaway

Use this address for newsletters, coupon sites, free trials, promotions, and any service you don’t consider important.

Private Accounts

In addition to your public addresses, it’s helpful to maintain two private accounts.

Sink Account

Never share this address publicly.

Its purpose is to aggregate mail forwarded from your other addresses so you only need to check one inbox.

If you’re using Gmail aliases (+ addressing), your primary Gmail account naturally serves this purpose.

Recovery Account

This email should never be shared with websites or individuals.

Its sole purpose is recovering your other email accounts.

Managing Your Emails

With multiple addresses configured, you might think managing email becomes more complicated.

Fortunately, it doesn’t.

Most email providers allow you to automatically forward mail to your Sink Account. You can also configure your email client to reply using the original recipient address, so conversations continue naturally regardless of which alias received the message.

The result is a single inbox with the security benefits of multiple email identities.

Recovery Emails

Your Recovery Account should not forward mail automatically.

Ideally, use a different email provider entirely. Privacy-focused providers such as Proton Mail are a good choice.

Don’t use this account for everyday communication—it should exist solely to receive password reset and account recovery emails.

Benefits

This setup provides several important advantages:

• Your Sink and Recovery accounts remain largely unknown to third-party services, making them less likely to appear in data breaches.
• Separating activities prevents a breach at one website from exposing more sensitive accounts.
• Attackers cannot easily correlate your identities across different services.
• If one email account is compromised, your hidden Recovery Account makes it much harder for an attacker to permanently lock you out.
• Day-to-day usage remains simple—you only need to monitor your Sink inbox while choosing the appropriate email alias when signing up for new services.

While a future article will explore credential management in greater detail, the general best practices are to:

• Use a password manager to generate strong, unique passwords.
• Enable two-factor authentication (2FA) or multi-factor authentication (MFA) wherever available.

Conclusion

Recent data breaches have shown that companies are attractive targets because they store vast amounts of personally identifiable information.

That information can be exploited in many ways, ranging from annoying spam campaigns to serious financial fraud and identity theft.

By organizing your email accounts thoughtfully, you can significantly reduce the impact of third-party breaches and make it much more difficult for attackers to compromise your digital identity.

In the next installment of this series, we’ll cover password management best practices.