# Email security for freelancers and solopreneurs: a one-person setup

URL: https://iblockspam.com/blog/email-security-for-freelancers-solopreneurs
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Setup guides
Author: iBlockSpam Team

> Email security for freelancers and one-person businesses: protect the inbox that resets everything, stop payment redirection and fake clients, own your domain.

## Short answer

For a freelancer, email is the master key: it resets your bank, payment and client-platform logins. Protect it with a passkey or authenticator app and saved backup codes, use your own domain with SPF, DKIM and DMARC, confirm any change to bank details by phone, refuse overpayments, and never sign in from a link in an unexpected email.

When you work alone, nobody else watches the inbox. There's no IT desk to spot a strange sign-in, no finance team to question a new bank account, and no colleague to ask "does this look right?" This guide sets up email security for a business of one: what to protect first, the scams that target freelancers specifically, and a checklist you can finish in an afternoon.

If you're still running the business from a personal webmail address, read [the risks of using personal Gmail for business](https://iblockspam.com/blog/using-personal-gmail-for-business-risks) first. Most of this guide assumes you have, or will soon have, your own domain.

## Why is email security so important for freelancers?

Email security matters more for freelancers than for most employees because a freelancer's inbox is the recovery address for everything: bank, payment processor, accounting software, domain registrar, client portals and social accounts. Whoever takes over that inbox can reset the rest, read every invoice and email your clients as you.

A larger business has layers that slow an attacker down. You have one account and one person. That makes the basics more important, not less. It also means you control every setting yourself, so you can turn on stronger protection today without waiting for anyone.

## What email threats do freelancers face?

These are the email attacks that most often hit one-person businesses. The table shows what each looks like and the single habit that stops it.

| Threat | What it looks like | The defense |
|---|---|---|
| Mailbox takeover | A login page that looks like your email provider; a "storage full" or "unusual sign-in" warning | Passkey or authenticator app; never sign in from an email link |
| Payment redirection | Your client gets "updated bank details" from you, or you get them from a client | Confirm every bank change by phone on a known number |
| Overpayment scam | A new client pays more than the quote and asks you to send back the difference | Refuse overpayments; wait for funds to truly clear |
| Fake invoice | A bill for a service or listing you never ordered | Pay only invoices you can match to a real order |
| Fake platform notice | "Your payout is on hold" or "your account is suspended" from a payment or marketplace brand | Open the app or type the site address yourself |
| Booby-trapped brief | An attachment or shared link presented as a project brief or contract | Preview in the browser; don't enable macros; be wary of HTML and archive files |

### Fake clients and overpayments

The overpayment scam is aimed squarely at freelancers. The FTC's [fake check guidance](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams) lists overpayments among the common setups: someone sends a check, sometimes for several thousand dollars and for more than you're owed, then asks you to send the difference back. For a freelancer, the "client" might agree a project, pay too much and ask for a quick refund of the extra. The check is fake. The FTC explains why the deposit looks real: "By law, banks have to make deposited funds available quickly," but "even if you see the funds in your account, that doesn't mean it's a good check." When it bounces weeks later, you repay the bank. The rule is simple: never accept a payment for more than the agreed amount, and never send money back from it.

### Payment redirection

Business email compromise (BEC) is fraud where criminals hack or imitate a mailbox to redirect payments. For freelancers it runs both ways. An attacker in your inbox can send your client an invoice with their own bank account, or an attacker in your client's inbox can tell you their payment details changed. The FBI's first prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3, September 2024](https://www.ic3.gov/PSA/2024/PSA240911)). In practice: a phone call, to a number you already had, before any new account gets paid. Our guide to [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) shows the full pattern.

### Fake invoices and platform notices

The FTC warns small businesses that "scammers also sometimes email you fake invoices," and that these are often phishing meant to get access to your data ([FTC, May 2026](https://www.consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)). Freelancers also get a steady stream of fake notices from the brands they depend on. See our explainers on [fake PayPal invoices](https://iblockspam.com/blog/fake-paypal-invoice-scam-emails), [fake DocuSign requests](https://iblockspam.com/blog/fake-docusign-e-signature-phishing) and [file-sharing notification phishing](https://iblockspam.com/blog/file-sharing-notification-phishing). The defense is the same each time: open the real app or type the address yourself.

### Attachments posing as work

Clients send files, so a file from a stranger rarely looks suspicious. Attackers exploit that with archives, HTML files and macro-enabled documents labeled as briefs or contracts. Our list of [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types) shows which file types deserve a second look.

## How do I protect my email account as a freelancer?

Protect your email account with multifactor authentication (MFA), a password manager and saved recovery options, in that order. MFA means signing in needs a second proof, such as a passkey, an authenticator app code or a security key, so a stolen password isn't enough on its own.

[CISA's Secure Our World](https://www.cisa.gov/secure-our-world) program lists four core steps: "Avoid and report phishing scams," "Use strong passwords," "Use multifactor authentication and a password manager," and "Update software." Those four cover most of what a freelancer needs.

Choose the strongest MFA your provider offers. CISA says "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication" ([CISA MFA](https://www.cisa.gov/MFA)), and the UK NCSC's [advice for sole traders](https://www.ncsc.gov.uk/section/advice-guidance/self-employed-sole-traders) says it "recommends users opt for passkeys over passwords wherever they are available." A passkey can't be typed into a fake login page, which defeats the most common takeover. Our guide to [passkeys and phishing-resistant MFA](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email) shows how to add one.

### Plan for losing your phone

A solo business can't call its own IT department to get back in. Before you need them:

- **Save backup codes.** Google lets you sign in with a single-use backup code if your usual second step isn't available ([Google Account Help](https://support.google.com/accounts/answer/1187538)). Microsoft and other providers have equivalents. Print them or store them in your password manager, not in the same inbox.
- **Register a second method,** such as a second passkey or a security key kept somewhere safe.
- **Check your recovery email and phone** are current and belong to you, not a former partner or an old number.

### Watch for quiet changes

An attacker who gets in often adds a forwarding rule or an inbox rule that hides replies from clients. Check your mail settings once a month for forwarding addresses, filters and connected apps you don't recognize. [Signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) lists what to look for, and [malicious inbox rules and auto-forwarding](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding) shows how they hide.

## Do freelancers need their own email domain?

Yes, once you invoice clients. Your own domain gives you an address nobody else can register, the ability to publish email authentication, and freedom to change providers without changing your address. It also turns a vague warning into a clear rule you can give clients: "I only email from @yourname.studio."

Email authentication uses three DNS records. SPF lists which servers may send mail for your domain, DKIM adds a signature to each message, and DMARC tells receivers what to do with mail that fails. A minimal starting point for a freelancer using one mailbox provider looks like this example:

```
example.studio.         TXT  "v=spf1 include:_spf.google.com ~all"
_dmarc.example.studio.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.studio"
```

Your provider supplies the exact SPF include and the DKIM key; the [SPF records by provider](https://iblockspam.com/spf) page lists the common ones. Start DMARC at `p=none` to collect reports, then move to `p=reject` once your invoicing tool, newsletter service and website forms all pass. Our [new domain email setup checklist](https://iblockspam.com/blog/new-domain-email-setup-checklist) covers every record, and [moving DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) covers the timeline.

Protect the domain itself, too. Turn on MFA at your registrar, enable registrar lock and auto-renew, and use a recovery address that isn't on the same domain. If the domain lapses, your email stops; [domain registrar security](https://iblockspam.com/blog/domain-registrar-security-registry-lock) explains the risks.

## How should I keep work and personal email separate?

Keep business mail in its own account on your own domain, and use a different account for personal life. Separation limits the damage of a breach: a leaked shopping site password or a phishing click on a personal account doesn't hand over your client list. It also makes it simpler to bring in a virtual assistant or a subcontractor later. Give them their own mailbox or delegated access, never your password.

Apply the same split to devices where you can. If your phone holds client mail, give it a screen lock, keep it updated, and use the official mail app. Our guide to [mobile email security](https://iblockspam.com/blog/mobile-email-security-byod) has more.

## What should I do if my freelance email is hacked?

Act within the hour, and warn clients before the attacker can use your name. Follow these steps:

1. **Change your password** from a clean device and **sign out all sessions** in your account's security settings.
2. **Review MFA methods** and remove any phone, app or passkey you didn't add.
3. **Delete unknown forwarding addresses, inbox rules and connected apps.**
4. **Check the sent folder** for invoices or messages you didn't send, and note who received them.
5. **Tell clients** by phone or from a known channel: don't pay any changed bank details, and ignore recent requests from you until confirmed.
6. **Call your bank** if any payment went to the wrong account. Speed matters most here. [BEC wire transfer recovery](https://iblockspam.com/blog/business-email-compromise-wire-transfer-recovery) explains the steps.
7. **Report it.** In the US, the FBI's [IC3](https://www.ic3.gov/) takes BEC complaints, and the FTC accepts reports of phishing and fake invoices at ReportFraud.ftc.gov.

## Freelancer email security checklist

Work through this in one sitting:

1. Add a passkey or authenticator app to your business email; remove SMS-only sign-in where you can.
2. Save backup codes offline and add a second sign-in method.
3. Move every password into a password manager, starting with email, bank and registrar.
4. Set up business email on your own domain with SPF, DKIM and DMARC.
5. Turn on registrar lock, auto-renew and registrar MFA.
6. Add a line to your invoice template: "Our bank details never change by email. Call us to confirm."
7. Write your own rule: no new payee and no refund of an overpayment without a phone check.
8. Check mail forwarding, filters and connected apps once a month.
9. Keep your laptop and phone updated, with screen locks.
10. Keep a list of your clients' phone numbers outside your inbox, so you can warn them if your email is compromised.

## Next steps

- Run your domain through the free [Email Health Check](https://iblockspam.com/tools/email-health-check) to see your MX, SPF, DKIM and DMARC in one scan, then build a DMARC record with the [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator).
- See which near-identical versions of your domain already exist with the [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator).
- Save your backup codes today, before you need them.
- If you later run several domains or want held mail reviewed in a scheduled quarantine digest, iBlockSpam's [small business plans](https://iblockspam.com/solutions/small-business) are priced per domain, not per mailbox. Filtering helps; it doesn't replace MFA or a phone check before payments.

Browse more guides on [setting up email security](https://iblockspam.com/blog/topic/setup).

## Frequently asked questions

### What is the most important security step for a freelancer's email?

Protect the email account itself with a passkey or an authenticator app, and save the backup codes somewhere offline. Your inbox can reset your bank, payment and client-platform passwords, so whoever controls it controls the business. CISA's Secure Our World advice puts multifactor authentication and a password manager among its four core steps.

### Should a freelancer use their own domain for email?

Yes, once you invoice clients. A domain address can't be registered by someone else the way a similar free webmail name can, you can publish SPF, DKIM and DMARC so receivers can reject mail that fakes your exact address, and you can change mail provider later without changing the address clients know.

### How do scammers target freelancers by email?

The common patterns are fake clients who overpay and ask for a refund of the difference, fake platform or payment notices that lead to login pages, attachments posing as project briefs, and criminals who hack or imitate a freelancer's mailbox to send clients new bank details. Each one relies on urgency and on acting from inside the email.

### A client says they received an invoice from me with different bank details. What should I do?

Tell the client not to pay and to call you on a number they already have. Then check your mailbox for unknown sign-ins, forwarding and inbox rules, change your password, sign out all sessions and review your MFA methods. If money was sent, the client should call their bank immediately and report it to the FBI's IC3 or local police.

### Do solo business owners need a spam filter beyond Gmail or Outlook?

Often not at first. The built-in filtering in Gmail, Outlook.com, Microsoft 365 and Google Workspace is a reasonable start when it's switched on. A separate filter becomes worth considering when you run several domains, want a quarantine digest you review on your schedule, or need mail held while your provider is down.

## Sources

- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world)
- [CISA: More than a Password (multifactor authentication)](https://www.cisa.gov/MFA)
- [NCSC: Cyber security advice for self employed and sole traders](https://www.ncsc.gov.uk/section/advice-guidance/self-employed-sole-traders)
- [FTC: How to spot, avoid, and report fake check scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-fake-check-scams)
- [FTC Consumer Alert: Run a small business? Pay your bills, not scammers (May 2026)](https://www.consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [Google Account Help: Sign in with backup codes](https://support.google.com/accounts/answer/1187538)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-freelancers-solopreneurs (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt