Your email is a critical gateway for account recovery.
Many platforms send notifications regarding logins, withdrawals, and account recovery via email. If these emails are automatically forwarded or hidden, you may miss vital alerts—posing a security risk even if your platform password remains uncompromised. If you stop receiving security emails, first check your spam folder, filter rules, forwarding settings, and storage capacity before assuming the platform failed to send them.
Distinguishing between various methods of persistent access
Automatic forwarding, filter-based redirection, email delegation, third-party app permissions, and active login sessions can all provide varying levels of access. Changing your email password alone may not revoke these existing authorizations. Follow the official security checklist provided by your email service to review each item; identify and remove any unfamiliar destination addresses, applications, or devices. Be careful, however—some rules may be legitimate, so do not delete them without verifying that they aren't essential to your regular workflow.
What to look for when reviewing rules
Check for rules targeting verification codes, security notifications, or emails from specific platforms—look for actions such as automatic archiving, deletion, marking as read, or forwarding. Do not rely solely on the rule's name, as these can often be generic or misleading. When documenting evidence, redact full email addresses and the content of messages; never expose valid verification codes, recovery links, or account balance information to third parties.
Secure and Restore Recovery Channels Before Cleaning
Verify that your backup email addresses, phone numbers, authentication methods, and recovery information still belong to you. Complete the official security procedures on a trusted device, and revoke access for unfamiliar applications or active sessions if necessary. Do not follow "urgent" links in emails to access a so-called "security center"; instead, navigate directly through the service provider’s official portal. If you suspect your device has also been compromised, you must address both the email account and the device simultaneously; otherwise, any new credentials could be exposed again.
Independently Audit Platform Accounts
Once email-related issues are resolved, review your platform accounts for unauthorized devices, API keys, whitelisted addresses, and recent activity logs. Restoring access to your email does not automatically ensure the security of your platform accounts. If you need to contact customer support, use their official ticketing system—provide a timeline and verifiable details of the suspicious activity, but never share seed phrases or private keys. If a support representative claims they need remote access to your computer to investigate email forwarding, carefully evaluate the source and the actual necessity of such a request.
Create a Monthly Checklist
Maintain a baseline list (excluding sensitive secrets) that tracks logged-in devices, third-party applications, email forwarding destinations, active filtering rules, and the dates when recovery information was last modified. Ensure that any new rules added have a clear, defined purpose, and remove them once they are no longer needed. This text provides a framework for security audits; it does not confirm that any specific email account has been compromised. If you discover actual unauthorized access, preserve the evidence and follow the service provider’s official procedures to address the situation.