Your inbox holds the key to your identity. Identity theft rarely starts with a stolen ID. It starts with email: resets and ID documents flow through it. I run AliasFleet, an email-alias service: one forwarding address per site, so a breach hands attackers an address tied to one site only.
The password reset is the weak point
Take the reset flow for what it is. You click forgot password, the site emails a link, and anyone holding it picks a new password. The old one never comes into it. Your inbox is the real credential. The password only guards the door to it.
BotBulwark calls a valid reset link a logged-in session in waiting, with permission to set a brand new password. Whoever gets one needs no old password, no knowledge of your habits, no patience. Token quality and token delivery are the whole security story.
Recovery is softer than login. Sites cap login attempts and lock accounts after failures, but tread lightly on recovery because they dread locking out real users. That caution opens the gap. OWASP tells builders that reset tokens must be randomly generated, long enough to resist guessing, stored securely, single-use and expiring, and that a reset request must not change the account until a valid token is shown. Every one of those rules exists because it has failed somewhere.
Take over the whole inbox and the damage jumps again. Adaptive Security describes an attacker with inbox control reading, sending, deleting and forwarding messages as the holder, setting quiet forwarding rules that copy inbound mail elsewhere, and reaching every service whose password reset runs through that email. Adaptive cites the Javelin 2025 Identity Fraud Study finding US consumers lost nearly $16 billion to account takeover fraud in 2024. Your inbox is not one account among many. It resets the rest.
From one leak to a stolen identity
The chain runs in four stages, none needing a genius.
A breach hands over your address and, often, a password. The raw material is vast. The Exploit.In combo list from late 2016 held 593 million unique email addresses with passwords, broadly circulated and used for credential stuffing, which Have I Been Pwned defines as trying a leaked pair where the owner reused the password. More recently, Troy Hunt put the deduplicated total of a 2025 stealer-log and credential compilation at nearly 2 billion unique email addresses with about 1.3 billion passwords.
Then the pair gets tried across site after site, fed into software that runs it everywhere. It works for one reason: people reuse passwords. Stolen credentials are no rare entry point either: the 2024 Verizon Data Breach Investigations Report found 31% of breaches over the past ten years involved stolen credentials, according to BARR Advisory's analysis.
Once they are inside your mail, logins turn into identity papers. Your mail holds what attackers need to impersonate you: full name, address, phone bills, order histories, travel bookings, scans of documents you emailed yourself years ago. Each one is a small fact. Together they are a profile.
Then the profile turns into fraud. The US FTC recorded 1.1 million identity theft reports in 2024, 449,032 of them about credit cards, the top category. Email was the contact method in a quarter of fraud reports where a contact method was identified, totalling $502 million in losses with a $600 median loss. Those are US figures, and they are reports, not all victims. The real number is bigger.
A clean result on Have I Been Pwned does not prove an address was never compromised either: many breaches never release data publicly, and many go undetected.
What attackers do with the pieces
The US Office of the Comptroller of the Currency lists the main forms: account takeover, new account fraud, tax identity theft, medical identity theft. Each uses a different slice of your inbox.
| What they have | What they do with it |
|---|---|
| Your address plus a reused password | Log into your accounts directly, or try the pair across dozens of sites |
| Access to your inbox | Reset passwords everywhere, read your mail, set forwarding rules to keep watching |
| Name, address, date of birth | Open new credit accounts or sign up for services in your name |
| Tax and income documents | File a fraudulent tax return and claim a refund in your name |
| Invoices and order history | Write phishing quoting your real purchases, sounding like the real company |
The tax version deserves naming because victims usually discover it late. The IRS says thieves use stolen data quickly: sell it, withdraw from bank accounts, make card purchases, or file a fraudulent tax return for a refund in the victim's name. You find out when your real return gets rejected. The same pattern holds wherever a government lets people file or claim online: the attacker files first, and the paperwork is theirs until you prove otherwise.
One alias per site breaks the chain
This is where the chain snaps. Give every site a different address, and a breach hands attackers an address belonging to one site only. It cannot be tied to your other accounts, because the thread connecting them, your one real address, was never in that database.
An email alias is a forwarding address, not a second inbox. Mail to it lands in your real inbox, and the sender never learns the address underneath. Give the shop one alias, the bank another, the forum a third. When spam or phishing arrives on the shop alias, you know where it came from. That is the leak-tracing mechanism in practice: the address itself names the source.
Then you pause the leaked alias. The impersonation channel dies while your real inbox keeps working. The set-up guide takes about two minutes per method, and the free tier covers 10 active aliases, enough for the accounts that matter most.
Two limits, stated plainly. Aliases do not un-leak anything. An address you already handed out sits in hundreds of databases, and no setup fixes that. Aliases only stop the list growing. Nor do they replace the rest of the work below. A per-site alias with a reused password behind it is a locked gate on an open field. The alias isolates the address. Unique passwords and two-factor authentication guard the accounts themselves.
Lock the inbox down first
Start here. Boring, and they work.
Give your email account a unique password and two-factor authentication, before the bank, because the email account resets the bank. Microsoft has said accounts using multi-factor authentication are more than 99.9% less likely to be compromised, a claim v500 Systems quotes from Microsoft's identity team. Treat it as a vendor claim, not gospel. Either way, a second factor on your phone changes the attack from guessing the password to stealing the password and the phone.
Stop reusing passwords. A password manager makes this a twenty-minute job, not a weekend. Every account gets its own password, so one leak cannot cascade.
On password changes, follow current guidance. NIST's SP 800-63B guidance says not to force periodic rotation. Change a password when there is evidence of compromise, check new passwords against known-compromised lists, and drop security questions as a standalone check: the answers are often guessable from public information.
Nothing stops the chain entirely. What stops it is layers. A unique password means the leaked pair fails elsewhere. Add two-factor authentication, and the password alone stops being enough. A per-site alias means the leaked address points nowhere useful. Remove one layer and the other two still hold. That is the point. The breach-response guide covers the full checklist if a notice has already landed.
If someone is already using your identity
Secure the email account first, then the bank, then everything else. Call each company's fraud department, ask them to close or freeze the affected accounts, and keep a written record of who you spoke to and when.
In the US, IdentityTheft.gov builds a personal recovery plan from what was exposed, with a report you can hand to businesses and credit bureaus. A fraud alert makes lenders verify your identity before issuing new credit in your name. A credit freeze blocks most new credit entirely until you lift it.
In the UK, contact your bank's fraud team first, then report to Action Fraud on 0300 123 2040, per the UK reporting guide. That guide also suggests CIFAS Protective Registration, which flags your credit file so lenders run extra checks before opening credit in your name, for a fee that was £30 for two years when the guide was written.
Elsewhere, your bank's fraud team is the fastest first call. Every country has its own route, and a local bank deals with this weekly.
Your email address will keep leading attackers to your identity while it stays the key to everything else. You cannot change that design. What you control is simpler: what each site holds, and how quickly you move when something slips. Start with the inbox. The rest follows from it.
