Press play to start listening
An email address is not a password, but it often connects a person’s online accounts. Criminals can combine it with a reused password, exposed personal information, or access to the inbox to attempt phishing, credential stuffing, password resets, and account takeover.
Check Point reported that 68% of malicious attacks were delivered through email. The Anti-Phishing Working Group (APWG) also recorded more than one million phishing attacks during the first quarter of 2025.
Why Exposed Email Addresses Are Useful to Criminals
Recent collections show how frequently email addresses appear in stolen data. SpyCloud found that 97% of phished data it recaptured in 2024 contained at least one email address. In November 2025, Troy Hunt added 2 billion unique email addresses and 1.3 billion passwords from credential-stuffing lists to Have I Been Pwned.
In June 2025, researchers reported finding 30 exposed datasets containing more than 16 billion credential records, according to Dexpose. The collection included data from infostealer logs and earlier breaches, so the figure does not represent 16 billion unique people or newly breached accounts.
Phishing and Business Email Compromise
Knowing a valid address helps criminals prepare phishing messages that imitate banks, employers, delivery companies, and online services. Business email compromise usually involves additional steps, such as impersonating a trusted sender or taking control of a genuine mailbox.
The FBI’s Internet Crime Complaint Center recorded approximately $2.77 billion in reported business email compromise losses during 2024. An email address alone does not cause these losses, but it gives criminals a confirmed destination for fraudulent requests.
Credential Stuffing and Account Enumeration
Credential stuffing becomes dangerous when an exposed email address appears with a reused password. The 2025 Verizon DBIR found that credential abuse accounted for 22% of initial access methods, while stolen credentials were involved in about 88% of breaches classified as Basic Web Application Attacks.
Cloudflare found that 41% of successful human logins used compromised passwords. When bots were included, leaked passwords appeared in 52% of detected authentication requests, with bots generating 95% of attempts involving those passwords.
Criminals also use login, registration, and password reset pages to determine whether an address is associated with an active account. Once confirmed, the address can be added to phishing and credential-stuffing lists.
SIM Swaps Require More Than an Email Address
SIM swapping usually requires personal information such as a name, address, date of birth, and mobile provider. Criminals collect these details from public records, previous breaches, and social media before impersonating a customer and requesting that their number be transferred.
In 2023, the FBI’s Internet Crime Complaint Center received (PDF) 1,075 SIM-swap complaints involving approximately $48.8 million in reported losses. In the UK, Cifas recorded nearly 3,000 cases in 2024, up 1,055% from 289 cases in 2023.
Control of a phone number can allow criminals to intercept SMS verification codes. It does not defeat TOTP apps, passkeys, or hardware security keys.
Reducing the Risk
Using a different email alias for each service can help identify where an address was originally used if it begins receiving spam or phishing messages. This does not prove that the service suffered a breach because addresses can also be shared, sold, or collected elsewhere. Most alias providers allow users to disable an affected address without replacing their primary account.
Password reuse presents a more direct risk. A free password manager can generate and store a separate password for each account, preventing a single leaked password from being successfully tested on other services. Users should protect the password manager with a unique master password and multifactor authentication.
TOTP codes are generated locally and, unlike SMS codes, cannot be intercepted through a SIM swap. Attackers can still steal them through real-time phishing pages. Where available, passkeys and hardware security keys provide phishing-resistant authentication.
Microsoft’s 2025 Digital Defense Report says modern MFA reduces the risk of identity compromise by more than 99%. According to Javelin research cited by Deepstrike, account takeover fraud caused nearly $16 billion in losses during 2024 and affected about 5.1 million US consumers.
No single measure prevents every attack. Email aliases limit exposure, password managers prevent reuse, and MFA adds another barrier if a password is stolen. Treating an email address as a public identifier, while properly protecting every account connected to it, offers a practical response to phishing and account takeover.
(Photo by Markus Winkler on Unsplash)
