What can someone do with your email address? What to know before you give it to a match

Your email address is the login name for many of your accounts and the place your password resets land. Giving it to a match is usually fine. Here is what changes when someone has it, and when they get into the inbox.

Short answer: With only your email address, someone can send you spam and phishing emails, sign you up for floods of mail, send extortion emails that quote an old leaked password, and try that password on your other accounts. They cannot open your inbox or your bank account with the address alone. The real damage starts if they get into the inbox, because reset links for your other accounts arrive there. A unique password and two-factor on your email account block most of the damage.

Your address versus your inbox: what someone can do with each

Every row traces to the FTC, the FBI, CISA or Microsoft, read October 18, 2026.

Sources: the FTC's guides to phishing and hacked email accounts, Microsoft on leaked email addresses, CISA's joint advisory AA24-131A on email bombing, and the FBI's 2020 warning on extortion emails.

Can a scammer do anything with just your email?

Yes, but less than most people fear. Microsoft says that at a basic level, a leaked address can mean a surge in spam. The bigger risk is that your address doubles as your username on many sites. In Microsoft's words: "If criminals have your email address that's half of what they need to sign into those sites as you." The other half is your password. Microsoft also warns that someone with your address could pretend to be you in scam messages to your friends, family or coworkers.

The FBI describes criminals making large numbers of password attempts using lists from data leak sites and social media, in a public service announcement from August 2026. A password you reused once can be tried everywhere.

Two more tactics:

• Extortion emails. In April 2020 the FTC and the FBI warned about emails claiming the sender recorded you on adult websites. Some include a real old password, and the FBI says they usually demand Bitcoin within about 48 hours. The FTC's advice is to not pay, delete the message and change that password.
• Sign-up floods. CISA calls this email bombing: a large volume of spam from real website registrations and subscriptions. In the attacks on organizations that CISA described in 2024, the criminals then called the target posing as tech support and offered to fix it. Don't accept that help.

Can someone hack your email with just your address?

Not on its own. They need your password or a code, usually from a breach, a phishing page, or a code you are tricked into sharing. In May 2026 the FTC warned about fake party invitations that ask you to enter your email username and password to see the details. If you hand those over, the FTC says, the scammer might take over your email and send the same scam to your contacts.

The FBI also describes criminals who request a password reset for a victim's social media account and then ask the victim for the code. Once the victim shares it, they can reset the password and get into the account. The FBI's advice is broader: be careful with any temporary password, PIN reset or access code you did not request, and do not share login information with anyone. For more on codes and texts, see what someone can do with your phone number.

What can your email address reveal about you?

That depends on where you have used it. Three places to check:

• Facebook. Facebook's help page says: "if someone searches using your email address and it includes your full name, your profile may be shown in search results." An address like firstname.lastname@ carries your name with it. Our guide to social media and phone numbers covers the rest of these settings.
• Gravatar. If you ever set up a Gravatar, its profile is public. Gravatar says it is a global public profile, and "By design it shares the information in your profile with all websites that utilize the Gravatar service." You can edit it.
• Data breaches. Have I Been Pwned, which an independent operator runs, listed 1,046 breaches on October 18, 2026. By our count of its public list that day, 674 of them included passwords. Check your own address there, and change any password from a breach it names.

What can someone do if they get into your inbox?

The FTC explains why this is where the damage happens: someone in your email "could request a password reset link for any of your other accounts, get the password reset link from your inbox, change your password, and lock you out of the account."

The FTC says hackers might create rules to forward your emails to another address, and tells you to delete any forwarding rules you didn't set up. They can also write to your friends and family as you, sometimes with fake pleas for help or money.

If you handle payments at work, the same access feeds business email compromise, which the FBI defines as a scam targeting people and businesses that regularly make wire transfers.

Can someone get into your bank account with your email?

Only through a chain of steps. No official source we read on October 18, 2026 says an email address on its own opens a bank account. The chain runs through one of three things: a phishing email that asks for your bank details, a reused password that works on your bank too, or someone in your inbox resetting your bank login.

Google's page on hacked accounts tells you to make sure nobody gave your bank instructions, such as to open an account or move money. Protecting your bank starts with your email: a password you use nowhere else, and two-factor turned on.

How common are email scams?

Phishing and spoofing was the most reported crime type to the FBI in 2025, with 191,561 complaints and $215,843,126 in reported losses, according to the IC3's 2025 Internet Crime Report. The same report counted 89,129 extortion complaints in 2025. The FBI defines phishing and spoofing as unsolicited emails, text messages and phone calls, and defines extortion by intimidation and threats, whatever the channel, so neither total counts email alone.

The FTC said email was the top method scammers used to contact people in 2024. In 2025, more people told the FTC a scammer first reached them by text than any other way, according to an FTC alert from May 2026. Among 2025 fraud reports to the FTC that indicated a loss and named how the scammer made contact, email accounted for 10%, according to an FTC Data Spotlight from April 2026. That share leaves out reports with no contact method and write-in methods the FTC classified as "other," and the FTC notes it did not collect reports during the 2025 government shutdown.

Is it safe to give your email to a dating match?

Usually, yes. No source we read says sharing an address with a match is unsafe in itself. The warning sign is a match who pushes to leave the app fast. Tinder and Hinge both say "users with bad intentions often try to move the conversation to text, messaging apps, email, or phone right away." The FTC describes the romance scam pattern the same way: "Soon they want to email, call, or message you off the platform." For what can happen after a move to WhatsApp, see WhatsApp dating scams.

Before you share an address, go through this list:

1. Stay in the app a little longer. Bumble's in-app calls let you talk without sharing your phone number or email.
2. Give a match an address you use for nothing else. Microsoft suggests keeping at least 2 addresses, one only for friends and family and one for signing into accounts, and says some people keep a third throwaway address. The throwaway kind is the one to share with a match.
3. Or use a forwarding address. With an iCloud+ subscription, Apple's Hide My Email creates random addresses that forward to your inbox, and you can deactivate one later. Don't share an Outlook alias: Microsoft says you can use any alias to sign in to your Microsoft account. A Gmail plus address still shows your real address before the plus sign, so it does not hide it.
4. Keep your full name and birth year out of the handle.
5. Check your address on Have I Been Pwned. Change any password from a breach it lists.
6. Make your security answers random. The FTC says to avoid questions with answers someone could find online, like your birthplace. First-date small talk covers exactly those facts.
7. Distrust login emails. Hinge says it "will never send you an email asking for your username and password information." Report any that arrive.

For the date itself, see how to stay safe on a first date.

Signs someone is misusing your email

1. A sudden flood of sign-up or newsletter emails.
2. Password reset emails or codes you didn't request.
3. An email that quotes one of your old passwords.
4. Notices about a login from a device or place you don't recognize.
5. A notice about a change to your username or password that you didn't make.
6. Friends asking about messages you never sent.
7. You can't log in.

The first three point to someone who has only the address. The last four, from the FTC's list, suggest someone may be in the account.

What if you gave a scammer your email?

Your address on its own is not an emergency. Work through what applies:

1. Stop replying, keep the messages, and don't send money. Report the profile in the dating app.
2. Ignore extortion emails. Don't pay. Change any password they quote, everywhere you used it.
3. Lock down the email account. Use a long, unique password (the FTC says aim for at least 15 characters) and turn on two-factor. Microsoft says multi-factor authentication "defeats 99% of the password attacks we see"; that is Microsoft's own figure, on an undated support page read October 18, 2026.
4. If someone got in, recover the account through your provider, sign out of all devices, delete forwarding rules you didn't set up, and check your recovery email and phone. Microsoft and Google each publish recovery steps.
5. Warn your contacts not to click links in emails from you.
6. Call your bank if you shared card or account details, or sent money. The FTC says a credit freeze is free to place and remove.
7. Report it. Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and report the scam at ReportFraud.ftc.gov and ic3.gov. If someone has your personal information, IdentityTheft.gov gives you a recovery plan.
8. If you are in danger, call 911.

For what romance scammers say before they ask for money, see signs of a romance scammer.

A quick check before a first date

TrulyWho checks a match's public accounts, photos and work from their email or phone in about a minute. Reports leave out dating and adult sites, and TrulyWho is not a consumer reporting agency, so it is for your own safety and never for jobs, credit or housing.

FAQ

Should I worry if a scammer has my email address?

Worry less than you might, but tighten a few things today. Expect more spam and phishing, and don't click links in unexpected messages. Give your email account a password you use nowhere else and turn on two-factor. Then check your address on Have I Been Pwned and change any password from a breach it lists.

Can someone else use my email address to sign up for things?

Yes. Many sites accept any address, so a stranger can sign you up for newsletters and accounts. In attacks on organizations, CISA warns, a sudden flood of these emails has been cover for something else, such as a fake support call that offers to fix it. Filter the flood, unsubscribe where it is safe, and never accept help you didn't ask for.

What if an email asks me to log in to my dating app, or a match wants a code?

Don't log in through the link, and don't send the code. Hinge says it never emails you to ask for your username and password. The FBI describes criminals who request a password reset for a victim's social media account and then ask the victim for the code. If you already shared one, change the password, turn on two-factor, sign out of all devices and report the profile in the dating app.

What should I do if someone is sending emails from my address?

Check your sent folder first. If you see messages you didn't send, someone may be in your account: change the password, sign out of all devices, turn on two-factor and delete any forwarding rules you didn't set up. If they aren't there, the sender may be spoofing your address, which means faking it. Either way, warn your contacts not to click links.

What if a scammer has my email and my phone number?

Treat them as one risk. The FTC says reset links for your other accounts arrive in your inbox, and the FBI describes criminals who ask for the reset code to a victim's social media account. Lock down the email account first, never share a code you didn't request, and check that the recovery email and phone on each account are still yours. For the phone side, see what someone can do with your phone number.