An alias account holds the map between your addresses and the sites you use. That map is worth more than any single mailbox, so it deserves the same care.

In order

1. Register a passkey, or enable a second factor. This is most of the protection available, and it takes two minutes. See Second factors and backup codes.
2. Save your recovery key somewhere physical. It is the difference between a lockout and an inconvenience.
3. Protect your recipient address. Password resets go there. An account here is only as safe as the inbox that can reset it.
4. Review app passwords and tokens occasionally. Revoke anything you cannot name.
5. Read the new device notices. A sign in you do not recognise is worth five minutes of your day.

What we will never do

Ask for your password by mail. Ask for a code by mail or chat. Ask for your recovery key at all. Ask you to install something to fix a delivery problem.

Anybody doing those things is not us, and the alias in the message they wrote to is the address you should switch off afterwards.

If you think something is wrong

Change your password, revoke every app password and token, check your list of recipients for an address you did not add, and write to us. Adding an unfamiliar recipient is the specific thing an intruder would do, because it redirects mail without touching a single alias.