3 simple security rules for working with email

As people and companies rely more and more on online platforms for their day-to-day activities, adopting some rules of conduct online has become a must, just like setting up a backup procedure.

These three rules will reduce the risk of users’ personal or sensitive data being exposed on the internet and will also keep useless spam away. Following them requires no technical skills at all.

Don’t create accounts on online platforms with the same password as your email addresses

Remembering several passwords can be quite hard, but it’s a must when it comes to online accounts and security. However big and secure a platform is, there’s a chance it will be compromised by hackers. Remember what happened to Twitter (the network has been called X since 2023).

For example, if you use the email address popescu@gmail.com with the password AnaAreMere123!$ and create an account with the same login details, then if Twitter is compromised, your email address will be compromised too.

That’s why IT experts advise against reusing passwords. The safe alternatives are turning on two-step verification or using a password manager, like Google’s. Today, password managers are also built into browsers and phones, and more and more services accept passkeys, which replace the password with your device’s fingerprint, face recognition or PIN.

Don’t use your personal or work address to subscribe to newsletters or to create accounts on untrustworthy platforms

A good, simple practice is not to use your personal or work address on platforms you don’t trust. People usually read the messages that reach their everyday email addresses with interest and ignore the ones in secondary inboxes.

If your main address is popescu@gmail.com, it wouldn’t hurt to create popescu.spam@gmail.com and use it strictly when websites force you to subscribe to access their content.

Your main address should only receive emails from the people you work with, from services you trust and from suppliers who invoice you.

Newsletters from slabeste-usor.co and masini-de-viteza.biz (made-up names, used only as examples) definitely shouldn’t slip in among the legitimate messages you tend to open in a hurry.

Use an address created specifically for social media

The reason is very simple. An address like popescu.social@gmail.com will spare you a huge volume of emails. Facebook, Twitter (now X) and Instagram have the bad habit of sending email notifications for every change or update, and we don’t think you want your inbox to be full all the time.

Although the messages are legitimate, the sheer volume of email can be frustrating. And if you have lots of unread messages in your inbox, you’ll tend to skim through them all quickly, and that way you risk opening malicious messages too.

What other email security rules matter in 2026?

The most important are two-step verification on your mailbox and checking any message that asks for money, data or urgent action. Your mailbox is the key to your other accounts: it’s how passwords are reset on almost every platform.

• Turn on two-step verification for your email address, with an authenticator app or a passkey, not just an SMS code.
• Check the sender’s real address, not just the display name. The steps are in the article on how to check whether an email is spam.
• Don’t change a supplier’s bank account based on an email alone. Call them on a number you already have, not the one in the message: fake invoice fraud often starts with a compromised mailbox.
• Don’t open unexpected attachments or links, even if the message seems to come from a colleague. You’ll find more on this in the article on phishing attacks.
• For companies: your email domain should have SPF, DKIM and DMARC configured, so nobody can easily send messages in the company’s name. We explain them in the article on how email works.

RezolvIT is an IT outsourcing company that takes security rules very seriously and uses innovative solutions to strengthen the security of the companies it works with. See what our IT security service includes.