You can protect the front door perfectly and still lose the house, because every account has a back door: the recovery options — the alternative phone number, the backup email address, and the forwarding rules that quietly send copies of your mail elsewhere.

Three real situations

An old address nobody removed. During a clean-up of a compromised account we found a recovery email address that belonged to no one at the company. Anyone controlling that address could have reset the password at any time — no hacking required.

Mail leaving a disabled account. At another client, three mailboxes had hidden forwarding rules sending copies of everything to an outside address left behind by a departed IT contractor. The accounts had been disabled. The mail kept flowing out anyway, because the rule lived inside the mailbox, not in the login.

A personal phone number as the company's second lock. A shared device was secured with an employee's private mobile number. When that person left, the company could no longer get into its own account — and the former employee still could.

Check these four things today

1. Recovery email address — is it yours, and is it current?
2. Recovery phone number — is it a company number, not a private one?
3. Forwarding rules in your mailbox — is anything being copied to an address you do not recognise?
4. Connected apps and devices — is anything listed that you no longer use?