What can someone do with your email address? 7 real risks

With only your email address, someone can send you phishing, try passwords leaked from other sites, send scare emails, fake your address in the From line, flood your inbox with sign-ups and check which services you use. They cannot read your mail, change your password or empty your bank account unless they also get your password or your phone number.

That second sentence is the part most articles skip. An email address is a username, not a key. Nearly every real harm needs one more ingredient, and the ranking below shows which one.

The 7 risks, ranked by how often they happen

The order comes from what people actually report. The FBI's 2025 Internet Crime Report counted 1,008,597 complaints last year, and phishing and spoofing was the largest category by number of complaints (191,561). Extortion came second (89,129).

Rank	What they do with your address	Extra thing they need	What stops it
1	Send you phishing	You clicking and typing	Checking the sender before acting
2	Try leaked passwords on your accounts	A password you reused	A separate password, plus two-factor
3	Send scare or extortion emails	Nothing	Knowing the script
4	Fake your address in the From line	Nothing	Your domain's DMARC policy, your contacts' filters
5	Sign you up for hundreds of lists	Nothing	Filters, aliases, not answering "IT support"
6	Check which sites you have accounts on	A site with a leaky login or reset form	Using different addresses for different things
7	Reset your passwords	Your phone number or your inbox	App-based or key-based two-factor

1. Send you phishing

This is the main reason anyone wants your address. A phishing email tries to get you to type a password, pay an invoice or open a file. The address itself is harmless; the danger is in what you do with the message. Our guide to spotting a phishing email covers the seven signs and a header check that takes a minute. (The FBI's phishing category also includes texts and calls, so not every one of those complaints started with an email.)

2. Try your leaked passwords

If your address was in a data breach, it is probably on a list next to the password you used on that site. Attackers feed those pairs into the login pages of other services and wait for a match. This only works if you used the same password somewhere else, which is why the UK's NCSC asks people to give their email account a password they use nowhere else. Its reasoning is blunt: someone inside your email can "reset all your other account passwords." You can see which breaches include your address in two minutes with our guide on checking whether your email was in a data breach.

3. Send scare emails, sometimes with your real password

A common version claims the sender filmed you through your webcam and demands payment in Bitcoin. To look convincing, it may quote a password you once used. The NCSC says the scammers "do not know if you have a webcam" and that a quoted password has "in all likelihood" come from an old breach. Don't pay and don't reply. If the quoted password is one you still use anywhere, change it today.

4. Pretend to be you

Anyone can type your address into the From line of an email, the same way anyone can write your return address on an envelope. This is spoofing, and it needs no access to your account. Whether the fake reaches your contacts depends on their mail filters and, for addresses on your own domain, on its DMARC setting. If friends say they got odd mail "from you" but your Sent folder is clean, read how to tell if an email is spoofed before you assume a break-in.

5. Bury your inbox in sign-ups

Someone can enter your address on hundreds of newsletter and account forms. Sometimes it is spite. Sometimes it is cover: a flood of mail can hide one real security alert. Microsoft documented a ransomware group doing exactly this in 2024: the attackers "sign up targeted emails to multiple email subscription services," then phoned the victim posing as IT support offering to fix the spam, and asked for remote access to the computer (Microsoft Threat Intelligence, May 2024). If your inbox suddenly fills up, search it for password resets, purchase confirmations and sign-in alerts, and never give remote access to someone who called you.

Gmail users get a version of this by accident. Gmail ignores dots, so j.ohnsmith and johnsmith are the same inbox, and Google admits it "can't prevent people from accidentally or maliciously using a dotted version of your address to sign up for subscription emails" (Gmail Help).

6. Find out which services you use

Many login, sign-up and password-reset forms answer differently depending on whether an address is registered: "no account with that email" versus "we've sent you a link." Security engineers call this user enumeration, and the OWASP guidance for developers says these forms should give "a generic error message" precisely so attackers can't do it (OWASP Authentication Cheat Sheet). Not every site follows that advice. The result is a map of where you have accounts, which makes a targeted phishing email far more believable ("Your order from the shop you actually use...").

7. Reset your passwords

A password reset sends a link or code to your inbox or your phone. So the address alone gets an attacker nowhere, but the address plus your phone number can. In a SIM swap, a criminal talks your mobile carrier into moving your number to their SIM, then requests resets that arrive by text. The FBI describes the method in a 2022 public service announcement and logged 971 SIM swap complaints in 2025. It is rare, but it is the scenario behind most "they got in without my password" stories.

What can't someone do with just your email address?

Read your email. That needs your password and any second factor, or a session stolen from your device.
Change your password. The reset goes to you, not to them.
Log into your bank. Banks want a password and usually a second check. Your email address is not enough.
Send real email from your account. They can fake the From line (risk 4), but the message comes from their server, not your mailbox, and won't appear in your Sent folder.
Find your home address from the address alone. That only happens if you have used the same address somewhere public with your name and location, such as an old forum profile or a listing that a people-search site has copied.
Steal your identity. Identity theft needs things like your Social Security number, date of birth or card details. An email address can be a step toward phishing for those, but by itself it opens nothing.

Is it safe to give out your email address?

Usually, yes. Email exists so people can write to you. The question is which address you give, and where.

Situation	Give your main address?
Friends, family, your employer, your doctor	Yes
Your bank, tax office, password manager	Yes, or better, a separate address used for nothing else
Online shops, apps, loyalty cards	An alias you can delete
Wi-Fi sign-in pages, contests, one-off downloads	An alias or a throwaway
A public profile or website	A contact alias, never the address that resets your accounts

The address that can reset your banking, your Apple or Google account and your password manager is the one worth keeping off the open internet. Everything else can get a stand-in. Gmail's plus addressing (you+shop@gmail.com) helps you sort mail, but it still shows your real address to anyone who reads it. A true alias is a separate address. In Secria Mail, aliases are built into the inbox: the Free plan includes 2, you can reply from them, and you can delete one the day it starts getting spam.

Signs someone is misusing your address

Password reset emails you didn't ask for. Someone typed your address into a reset form. Don't click; the reset still needs your inbox. If they keep coming, make sure two-factor is on for that service.
Sign-up confirmations for services you never used. Either a typo by someone else or the flood from risk 5. Unsubscribe with your mail app's button rather than links, and watch for a security alert hidden in the pile.
Friends receiving mail "from you." Check your Sent folder and your account's recent sign-in activity. Both clean means spoofing, not a hack.
Sign-in alerts from your provider for places you've never been. This is the one that means someone has your password. Follow our step-by-step guide for a hacked email right away.

What to do now

Give your email account a password you use nowhere else, ideally from a password manager.
Turn on two-factor authentication, using an authenticator app, passkey or security key where you can rather than text messages.
Check whether your address has been in a breach, and change any password that was exposed and reused.
Start using aliases for shopping and sign-ups, so your main address stops spreading.
If an email demands money, threatens you or quotes an old password, don't reply. In the US you can report it at ic3.gov; in the UK, the NCSC asks people to forward suspicious emails to report@phishing.gov.uk.

Frequently asked questions

Can someone hack you with just your email address?

Not on its own. To get into your account they also need your password, a code from your phone, or a session stolen from your device. The address makes you a target for phishing and password guessing, which is why a unique password and two-factor matter more than hiding the address.

Can someone steal your identity with your email address?

Not with the address alone. Identity theft relies on details like your Social Security number, date of birth and card numbers. The risk is that someone uses your address to phish for those, so treat any email asking for them as suspect.

Can someone find out where I live from my email address?

Only if that address is already linked to your name and location somewhere they can search, such as a public profile, a listing or a breached customer database. Using a separate address for public profiles keeps that link from forming.

Should I change my email address if it has been leaked?

Usually not. A leaked address mostly means more spam and phishing. A leaked password is what needs changing. Move to a new address only if spam has become unmanageable, and use aliases from then on.

Why am I getting password reset emails I didn't request?

Someone entered your address into that site's reset form, by mistake or on purpose. The link only works for whoever controls your inbox, so ignore it, don't click it, and make sure the account has two-factor turned on.

Your email address was always going to be known; it's an address. Keep the one that unlocks everything else to yourself, and hand out aliases from a free Secria mailbox for the rest.