Use strong passwords, verify sender addresses, and avoid opening suspicious attachments.
Your email account is the master key to your online life. Password reset links for every other account — your bank, your work systems, your social media — go to your email. If an attacker controls your email, they can reset and access virtually every account you have. This makes it your most critical account.
Use a strong, unique password for your email that you have not used anywhere else. Enable two-factor authentication — preferably using an authenticator app rather than SMS. These two steps make email account takeover extremely difficult even if your password appears in a data breach.
Do not click links in emails to access your bank, payment services, or any account where money is involved. Type the URL directly into your browser or use a bookmarked link you set up yourself. This single habit eliminates phishing as an attack vector for financial accounts.
Recognize that the "From" display name in an email is completely untrustworthy. Anyone can set it to anything, including "Apple Support" or "Your Bank." The actual sending domain — visible in the full sender address when expanded — is harder to fake and worth checking on any important email.