3 moves to protect your inbox
7 min
•Mar 31, 202618 days agoSummary
Kim Komando discusses three critical email and account security moves to protect your inbox from fraud and scams. The episode covers two-factor authentication, account takeover fraud prevention, and solutions for unwanted emails and unauthorized OneDrive sharing.
Insights
- Account takeover fraud exploits email as the master key to all linked accounts; securing email with 2FA is the single most effective defense
- Authenticator apps provide superior security to SMS-based 2FA by generating codes that exist only on your phone, making them immune to SIM swapping
- Cloud storage platforms like OneDrive and Google Drive have sharing notification vulnerabilities that scammers exploit; users must proactively disable all sharing alerts
- Scammers are evolving tactics beyond email to exploit calendar and document sharing features, requiring multi-layered account security approaches
- Even tech-savvy users struggle with persistent unwanted emails and sharing exploits, indicating a systemic platform design issue rather than user error
Trends
Account takeover fraud becoming mainstream attack vector targeting email as central identity hubShift from SMS-based 2FA to authenticator app adoption as security best practiceExploitation of cloud storage sharing features as emerging scam delivery mechanismCalendar injection scams using email-to-calendar integrations for phishing and solicitationGrowing disconnect between platform security features and actual user protection from social engineeringScammers targeting family-shared devices and multi-generational account accessMicrosoft and Google struggling with platform-level abuse of sharing notification systems
Topics
Two-factor authentication implementationAuthenticator apps (Google Authenticator, Microsoft Authenticator)Account takeover fraud preventionEmail security and spam filteringOneDrive sharing notification settingsGoogle Drive security settingsPassword reset link exploitationCalendar injection scamsPhishing and social engineeringMulti-account security strategyCloud storage platform vulnerabilitiesDevice sharing and family account security
Companies
Microsoft
OneDrive sharing vulnerability discussed; users must disable sharing notifications to prevent scammer exploitation
Google
Google Drive and Google Calendar experiencing similar sharing notification vulnerabilities as Microsoft platforms
PayPal
Referenced as example account compromised in account takeover fraud scenario affecting listener's friend
Amazon
Referenced as account compromised in account takeover fraud scenario affecting listener's friend
FBI
Official source for terminology and classification of account takeover fraud as criminal activity
People
Kim Komando
Host providing security advice and taking listener calls about email and account security issues
Jane
Long Island caller reporting persistent unwanted sexual solicitation emails and unauthorized OneDrive sharing
Quotes
"A criminal gets into your email, finds every account tied to that address, requests a password reset link. That link goes straight to your inbox. One click and just like that, your bank account belongs to a stranger."
Kim Komando•Account takeover fraud explanation
"These apps generate a fresh code every 30 seconds. And it only lives on your phone. So even if they have your password, they're locked out cold."
Kim Komando•Authenticator app security explanation
"See, these hackers and scammers, they are getting so creative. I mean, there's a calendar scam that's going on right now, where they, you get an email and then all of a sudden it pops up on your calendar."
Kim Komando•Emerging scam tactics discussion
"It's so weird that Microsoft hasn't been able to truly stop this, because you're not the only one that this is going to."
Kim Komando•OneDrive vulnerability discussion
Full Transcript