: If a user has not enabled Multi-Factor Authentication (MFA), a successful hit in this list gives an attacker full access to their emails, recovery options, and linked services.

: This is the single most effective defense. Even if an attacker has the correct password, they cannot enter without the second factor (e.g., Google Authenticator, Yubikey, or SMS).

: Gmail accounts often contain sensitive documents, tax information, and private communications.

: Check your Gmail "Last Account Activity" (located at the bottom right of the inbox) to see if there are any suspicious IP addresses or locations logged in. 4. Ethical & Legal Note