mail.com Security: Two-Factor Authentication and a Hacked Account

The most useful security setting on mail.com is two-factor authentication. With it on, logging in on the web needs a six-digit code from an authenticator app as well as your password.

Turn on two-factor authentication

1. Go to My Account and open the two-factor authentication settings (they’re also under Frequently Searched), click Two-factor authentication, then Start setup now.
2. Enter your password, then save your mobile number. mail.com texts you a confirmation code to enter — this number is also how you’ll recover your password later.
3. Install an authenticator app if you don’t have one, scan the QR code (or copy it) and enter the six-digit code the app shows.
4. Your secret key appears. Save the document and print it.
5. Check your contact information is correct — you’ll need it if you ever lose the key.

After you turn it on

• On the web: you enter a one-time code from the app every time you log in.
• In the mail.com app: you enter a code once.
• In Outlook, Thunderbird or another program (POP3/IMAP, Premium): you save an application-specific password in the program once, instead of your normal password.

Look after the secret key

If you lose the phone with your authenticator app, the secret key is how you get back in: start password recovery, enter the key when asked, and two-factor authentication is switched off. Turn it back on under My Account › Security Options. Keep the key — a PDF, plus your printout — somewhere other than your phone. Without it, getting back in means identity verification through mail.com’s Help Center, which mail.com warns can be difficult and take time.

If you think your account was hacked

mail.com’s steps, in order:

1. Change your password immediately. Can’t log in? Use password recovery — see resetting your mail.com password.
2. Run an antivirus scan on every device you use for email. If malware is found, change your password again once it’s removed.
3. Check your security settings: make sure your password recovery options are yours and up to date, and that spam protection is on.
4. Look for anything new in your filter rules, Mail Collector and aliases. Delete any alias you didn’t set up straight away.
5. Consider turning on two-factor authentication.

Bounces from mail you never sent? mail.com explains that spammers can forge your address (“spoofing”) without getting into your account, so that alone isn’t proof of a hack — but run the antivirus scan anyway. For phishing and fake support calls, see the email security hub.