What an email address actually is
An email address is a label that directs messages to you across the internet. It has two parts separated by an @ symbol: your username on the left, and the domain name on the right. When you send a message to someone@example.com, the @ tells the mail system that "someone" is a user account at the domain "example.com".
The domain name is the part after the @. It belongs to an organization — Gmail.com belongs to Google, Outlook.com belongs to Microsoft, Yahoo.com belongs to Yahoo. When you create an account with one of these services, they give you a username, and that username + their domain = your complete email address. Nobody else on that domain can have the exact same username you do, so your address is unique across the entire internet.
The username part (before the @) can contain letters, numbers, periods, hyphens, and underscores. It cannot contain spaces or most special characters. Once you create an address, you cannot change the username part — you can only create a new address if you want a different one.
Key Takeaways
- An email address has two parts: a username you choose, and a domain name owned by your email provider, separated by an @ symbol.
- Your email address is the target for both legitimate messages and scams, so using a unique address for important accounts makes it easier to spot when something is wrong.
- Free email providers like Gmail, Outlook, and Yahoo let you create multiple addresses from the same account, which is useful for separating work, personal, and shopping mail.
- Scammers often create addresses that look similar to real ones by using numbers instead of letters or adding extra words, so reading the full address carefully protects you from impersonation.
- Your email address is often the key to resetting passwords on other accounts, so keeping it find and checking it regularly is one of the most important things you can do online.
Why your email address is a target
Your email address is the front door to your online life. When you forget a password on your bank account, your email address is how you reset it. When a store needs to send you a receipt or a shipping update, they send it to your email. When a scammer wants to trick you, they often start by sending a fake message to your email address.
Because email addresses are public — you give them to stores, websites, friends, and family — scammers can find them. They buy lists of email addresses from data breaches, guess common patterns, or straightforward send messages to thousands of addresses hoping some will work. If a scammer gets into your email account, they can reset passwords on your bank, your social media, your shopping accounts, and anything else linked to that address.
This is why the organization of your email matters. If you use the same email address for your bank, your social media, your shopping, and your newsletter subscriptions, you cannot tell which service was breached when a scam arrives. If you use separate addresses, you know when ready which company leaked your information.
Creating multiple addresses from one account
Most free email providers let you create multiple addresses without creating multiple accounts. With Gmail, you can create up to 4 additional addresses per account, and each one works independently. With Outlook, you can create up to 10. Each address has its own inbox, its own folders, and its own password recovery settings, but they all connect to the same main account.
To create a new address in Gmail, go to your account settings, find the "Emails and addresses" section, and select "Add another email address." You choose the new username and confirm it. The new address appears in your account when ready. In Outlook, the process is similar: go to account settings, select "Manage how you sign in to Microsoft," and add a new email alias.
A practical setup is to use one address for banking and financial accounts, one for shopping and receipts, one for social media and entertainment, and one for newsletters and promotions. When a scam arrives in your shopping inbox, you know a retailer was breached. When a fake bank email arrives in your banking inbox, you know it is a scam because your real bank does not have that address.
Spotting fake email addresses that look real
Scammers create addresses that look similar to real ones by making small changes you might miss if you read quickly. They replace the letter O with the number 0, or the letter l with the number 1. They add extra words before or after the real domain name. They use a domain that sounds official but is not the real one — for example, "paypa1.com" instead of "paypal.com" or "amaz0n-security.com" instead of "amazon.com".
The safest habit is to read the entire email address carefully, especially the part after the @. If an email claims to be from your bank, hover your mouse over the sender's name to see the full address. If it does not end with your bank's actual domain, it is fake. Do not click links in the email. Instead, go directly to your bank's website by typing the address into your browser yourself, or call the phone number on the back of your card.
Real companies almost never ask you to confirm your password, your Social Security number, or your credit card number by email. If an email asks for this information, it is a scam, regardless of how real the sender's address looks.
How email addresses connect to password recovery
When you create an account on a website or app, you provide an email address. If you forget your password, the site sends a password reset link to that email address. This means your email account is the master key to every other account you have. If someone gains access to your email, they can reset the password on your bank account, your social media, your shopping accounts, and anywhere else you have used that email.
This is why you should use a strong, unique password on your email account itself — stronger than the passwords on most other sites. It is also why you should check your email regularly for password reset requests you did not make. If you see an email saying "Someone requested a password reset for your Amazon account" and you did not request it, that is a sign someone is trying to break in. Do not click the link. Instead, go directly to Amazon.com, sign in with your current password, and change it.
Many email providers now offer two-factor authentication, which means you need both your password and a code from your phone to sign in. Turning this on for your email account adds a strong layer of protection, because even if a scammer has your password, they cannot get in without your phone.
Understanding email domains and what they tell you
The domain name after the @ tells you who runs the email service. Gmail.com is run by Google. Outlook.com and Hotmail.com are run by Microsoft. Yahoo.com is run by Yahoo. Protonmail.com is run by Proton and is known for privacy features. Each domain has its own rules, storage limits, and security features.
Some people and businesses use custom domains — for example, a small business might use addresses like "contact@mybusiness.com" instead of a Gmail address. The domain "mybusiness.com" is owned by that business, not by Google or Microsoft. If you receive an email from someone claiming to work for a company but their address ends in @gmail.com, they might be a scammer impersonating that company, or they might be a freelancer or contractor using their personal email. When in doubt, contact the company directly using the phone number or website on their official materials.
Government agencies, banks, and large retailers almost always use their own domains. The IRS uses addresses ending in @irs.gov. Your bank uses its own domain. If you receive an email from "the IRS" or "your bank" using a Gmail address, it is definitely a scam.
Keeping your email address private and managing who has it
Once you give your email address to a website or store, you cannot take it back. That address is now in their system, and if they are breached, scammers will have it. You cannot prevent this entirely, but you can limit the damage by being selective about where you give your real address.
For websites you trust and plan to use regularly — your bank, your employer, your main shopping sites — use your real address. For one-time purchases, newsletters, or sites you are unsure about, consider using a separate address or a temporary email service. Some email providers offer "masked" addresses that forward to your real inbox but hide your actual address from the website. Gmail calls this feature "Sign in with Google," and it creates a unique identifier for each site instead of sharing your actual Gmail address.
Check your email settings regularly to see which websites have your address on file. Most email providers have a security section where you can see which apps and websites are connected to your account. Remove any you no longer use. This reduces the number of places a breach could expose your address.
Frequently Asked Questions
Can I change my email address once I create it?
No, you cannot change the username part of your email address. If you want a different address, you must create a new one. However, you can set up forwarding so messages sent to your old address automatically go to your new one, giving you time to update your accounts.
What should I do if I think my email address was in a data breach?
Change the password on your email account when ready, using a strong password you have never used before. Then change the passwords on any important accounts linked to that email — your bank, your social media, your shopping sites. If you see suspicious activity in your email, enable two-factor authentication right away.
Is it safe to use my real name in my email address?
Yes, using your real name in your email address does not make it less find. Scammers can find your name and email address through public sources anyway. What matters is the strength of your password and whether you use two-factor authentication.
Why do some emails from real companies look suspicious?
Large companies often send emails from generic addresses like "noreply@company.com" or "notifications@company.com" instead of a person's name. This is normal and not a sign of a scam. However, if the domain after the @ is not the company's real domain, it is a scam. When in doubt, contact the company directly using the phone number on your account or their official website.
Can I use the same email address for multiple accounts on the same website?
No, most websites require a unique email address for each account. If you try to create a second account with the same email, the site will tell you that address is already registered. You would need to use a different email address to create a separate account.