Spam Starts Arriving at Your Alias—
Don’t Delete It Yet

One Unfamiliar Email Doesn’t Prove an Address Was Leaked

Businesses often send email through payment, shipping, support, or marketing providers, so the sender domain may differ from the site where you signed up. First compare recent activity, order dates, and email authentication details to distinguish legitimate business messages from unrelated deliveries.

If the same dedicated alias keeps receiving promotions unrelated to the original service, credential-stuffing threats, fake login alerts, or messages from lists you never subscribed to, treat it as an exposure signal. Don’t click an unsubscribe link in an unfamiliar email to “verify” the source—some links confirm that someone is reading the address.

Follow Six Steps to Avoid Locking Yourself Out

1. Confirm the Alias’s Sole Source

Search for the complete alias in your password manager or signup records. If it was used for only one site, suspicious messages can provide a strong clue about the source; if it was reused, list every linked account before drawing conclusions.

2. Sign In to the Original Service Through a Trusted Channel

Don’t use buttons in the suspicious email. Type the website address manually or open the official app, then check login history, active sessions, security alerts, and account details for changes.

3. Secure High-Value Accounts First

Change the password for every account you still use to a unique, strong password, enable app-based two-factor authentication, and save your recovery codes. If that password was ever used elsewhere, change those passwords one by one according to importance.

4. Create a New Dedicated Address

Create a new forwarding alias for each service you need to keep, change the email in the account settings, and verify that the new address receives messages. Don’t pause the old address until migration is complete.

5. Watch for Essential Mail at the Old Address

Keep a short observation period to confirm that refunds, orders, security alerts, and password recovery messages have moved to the new address. Note any services still sending mail to the old alias and complete the migration.

6. Pause the Old Alias and Keep a Record

Pausing is more reversible than deleting. Once you’re sure no legitimate mail is still arriving, decide whether to delete it permanently. Record the leak date and source in your password manager so you don’t reuse it later.

The More Urgent the Email, the More You Should Step Away

High-pressure messages such as “Your account will close in ten minutes” or “A large payment was detected” are often designed to trigger clicks. Real security incidents may also sound urgent, so wording alone can’t prove whether a message is genuine; always verify it through a known, trusted channel.

Check whether the display name matches the real sender address, look for substituted characters in the domain, and beware of pages asking for your email password, two-factor code, or recovery code. Enter verification codes only into a service you opened yourself and confirmed to be trustworthy.

• Don’t download archives from unknown sources or enable macros in documents;
• Don’t reply with your name, phone number, or confirmation that the account exists;
• Don’t publish the complete email header on a forum, as it may contain identifying information;
• When reporting an issue, use the security channel listed on the service’s official website.

Pausing, Restoring, and Deleting Solve Different Problems

Pausing stops new messages from being forwarded while preserving the option to restore the alias later, making it suitable during investigation and migration. Restore it if you need to find a missed service or briefly receive essential account-change messages.

Deletion is a final step and is usually irreversible. It also can’t ensure that the address disappears from the sender’s database. If the alias is still an account’s only recovery route, deleting it turns an attack surface into an availability risk for you. Open the forwarding dashboard to check the alias status and proceed in order.

Design for Traceability When You Sign Up Next Time

Use one alias per site so you can quickly narrow down the source when suspicious mail appears. Record the source, date, and purpose when creating it, and don’t build your name, birthday, or internal company ID into the address prefix.

For low-value interactions that expire when the task is complete, use atemporary inbox; keep a separate forwarding alias for long-term accounts. Review unused aliases and old accounts every quarter: close the account first, then revoke the address to avoid leaving an unmanaged recovery route.

Address isolation can’t prevent all data sharing, but it can limit a single exposure to a smaller scope. Combined with unique passwords, two-factor authentication, and trusted sign-ins, your response becomes “migrate one source” instead of “change your entire primary email.”