Use of an email address by another person falls into two cases. In an account takeover, another person is inside the holder's own account. In misdirected use, another person gives the holder's address at signup or a sender types the wrong address, and mail for another person reaches the holder's inbox while the holder's own account remains untouched. The response follows the case: takeover requires recovery and a full security check, while misdirected use requires a sender message, a report, or a request to the service holding the wrong account.
Account takeover and misdirected use
Email is also the reset route for other accounts, so the distinction matters. The FTC states that a person who controls an email inbox can request password reset links for other accounts, read those links, change those passwords, and lock the holder out. An email takeover is therefore treated before other account problems in the same incident, while a misdirected signup gives the stranger no such route, because the stranger does not control the inbox.
Takeover signs listed by the FTC include a sign-in failure after a password change the holder did not make, a notification about a change to the username, password, or recovery details, a sign-in from a device or location the holder does not recognise, and contacts reporting messages the holder did not send.
Misdirected use has different causes: a typing error at signup or on a form, a person who remembers an address incorrectly and repeats the same wrong address at several services, or a sender who picks the wrong contact from an address book. None of those causes, on their own, shows that the holder's account was entered. Google states that the owner of a consumer Gmail address owns all dotted versions of that address, and that no one else can register a dotted version as a separate Gmail account, with mail meant for john.43.smith@gmail.com reaching the owner of john.smith@gmail.com when the sender typed the shorter address. The exception is work, school, or other organisation domains, where Google states that dots do change the address.
Triage
Triage proceeds through three checks, in order: sign-in to the email account itself, where a failure after a password the holder knows, or a message that the password was changed, points to takeover; the account record, where recent sign-ins, devices, and security events are examined for entries the holder does not recognise; and the mail itself, where the subject, sender, and account named in the message show whether the message concerns the holder's own account or another person's account.
If the first check fails, or the second check shows unfamiliar devices or changes, the case is handled as a takeover, even if some mail looks ordinary. If sign-in works, the devices look familiar, and the mail is clearly for another person, the case is handled as misdirected use, while a mixed picture is handled as a takeover until the unfamiliar activity is explained. A breach search adds context but does not settle triage: Have I Been Pwned shows whether an address appeared in a known breach, not whether a particular stranger entered a particular account, so a clean result does not prove that no takeover happened, and a breach result does not prove that a particular stranger caused the incident.
Account takeover recovery
Recovery runs through the provider's own route. Google's guidance states that the account recovery page is used when someone changed the account information, such as the password or recovery phone number, when someone deleted the account, or when the holder cannot sign in for another reason. Microsoft's guidance puts a malware scan before a password change: the holder runs a full scan with up to date antivirus software, and only then changes or resets the password, because a password changed on a compromised device can be captured again.
After access is regained, the check follows a fixed order: unfamiliar devices and sessions are removed, the password is changed to a new password not reused on other accounts, and recovery details are checked, with any recovery email address or phone number the holder does not control removed. Connected accounts, forwarding rules, and automatic replies are checked, because Microsoft lists those three settings as settings to review after someone else had access, and Google lists labels, filters, and forwarding rules the holder did not set up as items to remove.
Microsoft's recovery form is the route when sign-in is not possible and the normal reset route fails. Microsoft's form guidance states that the form asks questions only the holder can answer, that as much detail as possible should be included, and that the result is sent to a working email address supplied on the form within 24 hours. The same page states that if two-step verification is on and no alternate verification method is accessible, support agents are not allowed to send password reset links or change account details, so a holder who loses every second factor may not recover through support at all, and the form can fail verification.
Apple states that if the password cannot be reset, or the holder cannot sign in, account recovery starts at iforgot.apple.com and access returns after an account recovery waiting period, with no fixed length stated on the page read for this piece. Apple lists compromised-account signs including an unrequested two-factor authentication code, a password that no longer works, and a device locked or placed in Lost Mode by someone else. After regaining control, Apple lists device removal and a check that every email address and phone number linked to the account is controlled by the holder.
Post-recovery security checks
A second sign-in step is added after recovery, not before, because the holder needs stable access first. Google describes 2-Step Verification as sign-in with something known, the password, plus something held, a phone, a security key, or a printed code. The FTC lists the same order after regaining control: change the password, sign out of all devices, turn on two-factor authentication, and check recovery information. A passkey is a stronger form of the second step in Google's description: Google states that passkeys cannot be shared, copied, written down, or accidentally given to someone else, and that a passkey proves possession of the device used to sign in.
The rest of the check is a sweep of places where access persists: the sent folder, for messages the holder did not send; the deleted folder, for messages read and then deleted by someone else; third-party app access, with apps the holder does not recognise removed; and other accounts that used the same password, changed because a password taken from one account is tried on others. The sweep is finished when no unfamiliar device, rule, app, or recovery detail remains, and a second sign-in step protects future sign-ins without undoing messages already sent, or data already read, during a takeover.
Misdirected mail handling
Google's dots page gives three moves for mail that belongs to someone else: notification of the sender when the mail seems irrelevant but not suspicious, a report for a suspicious email without clicking links or sharing personal information, and contact with the website to remove the address from a mailing list the holder did not join. Google also states that it cannot prevent people from accidentally or maliciously using a dotted version of the address to sign up for subscription emails, so repeat mail from the same wrong signup may keep arriving even after one message is deleted.
For repeat mail, filters and blocks do the ongoing work. Gmail filters can send mail matching a sender or subject to a label, or archive, delete, star, or forward it. Blocking a sender in Gmail sends all future mail from that sender to Spam. A filter on the stranger's name, or on the service that keeps sending the wrong account's mail, keeps the inbox usable while the underlying error is fixed at the service, but blocking is not a fix for the service's record, and it does not stop the stranger from using the address again at a new service, because a filter or block controls the holder's inbox, not the stranger's behaviour or the service's record.
Attachments are not opened, links are not followed, replies carry no personal details, and the stranger's account or reset links are not used. A short reply to the sender stating the wrong address is enough when the sender is a real person or a real business. When the mail looks like a phishing attempt, the mail is reported and deleted, and when the mail contains another person's private details, the holder deletes it after notifying the sender, and does not forward it on.
Accounts opened with a wrong address
A service holds an account under the holder's address, and the stranger may or may not control that account. The holder contacts the service and asks for the address to be removed, or for the account to be closed, with the request naming the address, the date of the mail if known, and the fact that the holder did not create the account, and a record of the request is kept, covering the date, the service, and the reply.
Some services remove the address on request; others ask for proof of control, given by receiving a message at that address; others close only after a waiting period, or only at the account holder's request. The holder cannot force closure from inside an account the holder does not control. Reset links for the stranger's account are not used to enter it: entry would create an unauthorised access problem without fixing the service's record. Money cases, or continued use after a removal request, go through the service's fraud or abuse route, not a repeated contact form, and mail under a different spelling of the address is watched, because a stranger who mistyped once may mistype again.
Fraud and identity theft reporting
Reporting is for cases with fraud, identity misuse, or a threat, not for every mistyped newsletter. When personal information was stolen, or an account was opened in the holder's name, the FTC's identity theft site provides a report and a personal recovery plan: IdentityTheft.gov. Fraud is reported at ReportFraud.ftc.gov, and cyber-enabled crime is reported to the FBI's Internet Crime Complaint Center at IC3. The Justice Department's reporting page lists the same split: consumer fraud and identity theft go to the FTC, and internet fraud goes to IC3. The FBI's identity theft resources list the same actions for a person whose information was misused: contact the company, report at IdentityTheft.gov, place a fraud alert or credit freeze with the credit bureaus, and keep records of every communication.
A report does not recover an account. It creates a record that a bank, a service, or law enforcement may ask for later, so the holder keeps the dates, the services contacted, the replies received, and any reference numbers. When money left an account, the bank or card provider is contacted first, through a number the holder already trusts, and the report is filed in parallel. When the case is only a mistyped address with no fraud, a report adds nothing, and the sender and service contacts described above are the right route.
Alias use after triage
AliasFleet provides email aliases that forward to a verified destination inbox, with one alias per website. In the misdirected-mail case, a stranger's mistyped signup for one service arrives on that service's alias, not on the address the holder uses for the holder's own accounts, and that alias can be paused or removed without changing the addresses used for other accounts. In the takeover case, the same structure does not replace recovery: the holder's own account still needs the provider recovery route, the device check, and the second sign-in step described above. AliasFleet does not recover a taken-over account, and it does not close a stranger's account at another service. The separation helps after triage, by keeping one service's wrong mail away from the rest of the inbox. Financial accounts are outside this separation: the address on a bank account is kept stable and is not changed as part of this triage.
Top comments (0)