Description: Most People Use Gmail Daily — Almost Nobody Uses This Built-In Security Feature. There is a simple, built-in mechanism in Gmail that materially improves personal and organizational security awareness: email aliasing (plus addressing).
How an attack usually happens
- You register on a third-party platform using
personal@gmail.com. - That platform suffers a data breach.
- Your email appears in breach datasets and phishing lists.
- You later receive phishing emails sent to
personal@gmail.com. - You have no attribution signal—no way to know which service leaked your data.
The defensive technique
Instead of registering with: personal@gmail.com, use: personal+service_name@gmail.com.
Examples
personal+pfacebook@gmail.compersonal+pinstagram@gmail.compersonal+surveydonkey@gmail.comprofessional+resume@gmail.com
Why this matters
- When a phishing email arrives addressed to
personal+pfacebook@gmail.com, attribution is immediate. - You know exactly which service leaked or mishandled your data.
- You can rotate credentials, revoke access, or delete the account immediately.
- You gain visibility instead of guessing.
Security value
- Breach source identification
- Faster incident response
- Reduced phishing effectiveness
- Improved personal OPSEC
- Better hygiene for corporate signups and test accounts
This is not a workaround. This is a supported feature that most users ignore.
Use cases:
- Students & resumes: Track where your resume leaks by tagging each job portal or recruiter.
- Social media signups: Identify which platform sold or lost your email data.
- E-commerce accounts: Detect marketplaces sharing data with third-party advertisers.
- Free tools and trials: Know which service converts your email into spam.
- Newsletters: Instantly trace who ignored unsubscribe requests.
- Online forums: Attribute data exposure from low-trust communities.
- Banking and finance alerts: Separate high-risk communications from noise.
- Corporate test accounts: Maintain clean attribution during QA and security testing.
- Event registrations: Identify organizers who mishandle attendee data.
- Third-party integrations: Detect leaks introduced via OAuth or partner ecosystems.
Security is not only about tools and exploits.
It is about signal preservation.