Every month we help at least one new client clean up after an email breach. Almost every one of them has the same thing in common: a mailbox or two still set up with POP or IMAP, outside their main security policies, often without multi-factor authentication, and often with a password that has been quietly in the wild for years.
The owner usually had no idea. The attacker did.
What POP and IMAP actually are
POP (Post Office Protocol) and IMAP (Internet Message Access Protocol) are the two oldest ways for an email program to pick up mail. POP dates from 1984, IMAP from 1986. They were designed when the big worry was downloading mail over a slow modem, not stopping a Russian criminal syndicate from automating a million login attempts a minute.
They work roughly like this: your email program (Outlook, Thunderbird, Mac Mail, your phone, a scanner, an old copier, an in-house line-of-business app) connects to the mail server with a username and a password, and the server lets it in. That’s it. No second factor. No device check. No question about where the login came from, or what time of day, or whether this is the first time anyone from Chile has signed in to your account.
In the 1990s that was fine. In 2026 it’s the open side door almost every email breach walks through.
Why they’re still around
Three reasons:
1. Legacy software. An old accounts package, a line-of-business app, a photocopier set up to email scans, an industry-specific tool from a vendor who went out of business in 2019. All of these often only know how to send and receive mail using POP, IMAP or basic SMTP authentication.
2. Legacy mailboxes. Someone set up Outlook on a laptop in 2015 with POP or IMAP. They’ve never changed it. The password has never rotated. There’s no MFA because POP and IMAP can’t do MFA. Nobody has noticed because the email just keeps working.
3. Legacy email providers. If your business email is on a shared web hosting account (cPanel, your webhost’s email add-on), on a legacy GoDaddy Workspace mailbox, or on an on-prem mail server from a decade ago, the default way to connect is POP or IMAP. These providers often don’t even offer modern authentication as an option.
Why they’re a serious problem
The core issue is this: POP and IMAP authenticate with a username and password, full stop. There’s no way to add MFA. There’s no way to say “only let this user in from the UK”. There’s no way to say “lock this account after five failed attempts in a minute”. There’s no way to say “block the login if we’ve never seen this device before”.
So when (not if) one of your team’s passwords ends up in a breach dump somewhere, an attacker can test it against your mailbox from anywhere in the world, as fast as their script can go, with no obstacles.
Once they’re in, the usual pattern is:
1. Set up a quiet forwarding rule to a Gmail address they control.
2. Watch for an invoice conversation with a supplier or customer.
3. Spoof a reply with new bank details.
4. Collect the payment, delete the rule, delete their presence.
You find out when the real supplier calls and asks where their money is.
This isn’t theoretical. It’s the single most common successful attack on small UK businesses right now, and it almost always starts with legacy email authentication.
Check your own domain, right now
Enter your domain below. We will run the same checks on it, live, and show you where you stand. No email required.
We don’t store the domain. Results generated live from public DNS via Cloudflare.
How to tell if you’ve got it
Three quick checks:
1. Who hosts your email? If the answer involves “my webhost”, “the hosting account”, “cPanel”, “GoDaddy”, or “an Exchange server in the office”, there’s a strong chance POP or IMAP is enabled by default.
2. Is MFA on every mailbox? If you can’t say “yes, enforced, no exceptions”, some mailboxes are probably still on POP or IMAP, because POP and IMAP simply can’t do MFA.
3. What about the shared mailboxes, the scanner, the booking system? These are the ones most often forgotten. The main mailboxes may be properly set up and the scanner is still using IMAP with a password written on a Post-it.
On Microsoft 365 you can see this directly. Admin centre → Settings → Org settings → Modern authentication. If “Allow access to basic authentication protocols” is ticked for any protocol, those protocols can and probably will be used by someone.
What to switch to
The short answer is modern authentication, on Microsoft 365 or Google Workspace, with MFA enforced for everyone, and basic authentication protocols switched off at the tenant level.
That doesn’t necessarily mean a big migration. For most small UK businesses it means:
1. If you’re already on Microsoft 365 or Google Workspace, turn off POP, IMAP and basic SMTP auth at the tenant level, enforce MFA on every account, and track down any device or app that stops working so you can either upgrade it or replace it.
2. If you’re on shared web hosting, legacy GoDaddy, or an on-prem Exchange server, plan a migration to Microsoft 365 or Google Workspace. For most small businesses this is a weekend of work by someone who’s done it before, and about £7 per user per month in licensing.
3. For scanners, copiers and old line-of-business apps that only know how to send mail via basic SMTP, create a dedicated “app password” or “high-trust IP” exception in your mail provider, apply strict IP restrictions, and set a reminder to review it every six months.
None of this is cutting-edge security. It’s hygiene. But the single step of turning off basic authentication closes the door through which most successful small-business email breaches walk.
Check your own domain in 30 seconds
Our free domain security checker runs the same tests on your domain, live. No email required.
Where we come in
Our Microsoft 365 Audit explicitly checks for basic authentication, legacy sign-in protocols and any mailbox still using them. If any are found, we flag which account, which protocol, and what to do about it. If you’re not yet on Microsoft 365, we can also run through a sensible migration plan tailored to your business, including the awkward bits (that one scanner, that one app).
Or if you want a direct answer on whether your current setup is leaving you exposed, Book a 30-minute IT review. Thirty minutes, plain English, no pressure.