An email account can look normal while quietly sending copies of selected messages somewhere else. Attackers who gain access sometimes create forwarding settings or inbox rules to watch conversations, hide warnings, or collect messages about invoices and password resets. An unfamiliar rule does not always prove an attack—old workflows and connected apps can create legitimate rules—but it deserves prompt review.
What an email forwarding rule can do
Automatic forwarding can send every incoming message to another address. A more selective inbox rule can act only on messages containing words such as “invoice,” “payment,” or “password,” then forward, archive, move, or delete them. Microsoft’s guidance on suspicious inbox manipulation notes that compromised accounts may be used to read mail, forward messages externally, hide traces, and send phishing messages.
This is one reason changing the password is necessary but not always sufficient. A rule that remains in the mailbox may continue acting after the password changes.
Warning signs worth checking
- Messages disappear from the inbox or move into an unfamiliar folder.
- Customers or coworkers receive replies you did not send.
- A forwarding notice appears at the top of the mailbox.
- Password-reset or security-alert messages are missing.
- Sent, deleted, or archived folders contain activity you do not recognize.
- A payment conversation suddenly introduces different banking details.
None of these signs should be treated as proof on its own. Mail apps, shared mailboxes, assistants, and legitimate filters can produce similar behavior. The goal is to compare every rule and forwarding address with a workflow you actually recognize.
Review Microsoft 365 or Outlook rules
In Outlook on the web, open Settings and review Mail rules and forwarding settings. Look for rules with vague names, rules that forward or redirect externally, and rules that delete or hide security messages. Business administrators should also check mailbox-level forwarding, active sessions, audit information, and other accounts affected by the same incident.
Microsoft recommends inspecting inbox rules, recently added external forwarding, sent items, and message traces when responding to a compromised Microsoft 365 account. Administrative steps vary by license and role; if you do not manage the organization, report the issue to the authorized administrator instead of experimenting with tenant settings.
Review Gmail forwarding and filters
In Gmail on a computer, open Settings → See all settings. Review Forwarding and POP/IMAP, then Filters and Blocked Addresses. Google explains that automatic forwarding can send all messages to another address, while filters can forward only selected messages. Remove or disable anything you cannot explain after recording the details.
For Google Workspace, an administrator may also control whether users can forward mail outside the organization. Personal Gmail users will not have the same administrative controls, but they can still review forwarding, filters, signed-in devices, recovery information, and third-party account access.
If you find a rule you did not create
- Record it. Note or capture the rule name, destination, actions, and time discovered. For a business account, follow the organization’s evidence and incident-response process.
- Use a trusted device. Open the provider’s official site from a bookmark or typed address—not a link from an unexpected message.
- Change the password. Use a new, unique password that is not a variation of the old one.
- Revoke sessions. Sign out unfamiliar devices and active sessions where the provider supports it.
- Remove malicious access. Delete the unauthorized rule or forwarding address, and remove unknown recovery methods or connected apps.
- Strengthen MFA. Turn on multi-factor authentication, preferably a phishing-resistant option such as a passkey or security key when supported.
- Review activity. Check sent, deleted, archived, and recovery messages, plus any payment or account changes.
If you received unexpected approval prompts during the incident, follow our guide on what to do with an unfamiliar MFA prompt. If the problem began with a message or link, use our suspicious-link response checklist.
Verify payment changes outside email
When a compromised mailbox is used in an invoice conversation, a fraudulent banking change can look like part of the existing thread. Verify new payment instructions through a phone number or contact method you already trust. Do not use the phone number included in the suspicious message. Businesses should pause affected payments and notify their bank or payment provider promptly when money may have been sent incorrectly.
Check neighboring accounts
Email often controls password recovery for other services. Review important financial, cloud-storage, shopping, social, and administrator accounts for password resets, new devices, or changed recovery details. If the email password was reused, change every account that shared it. Our practical security checklist covers unique passwords, updates, recovery, and safer sign-in layers.
Prevention for households and small businesses
- Use a password manager to keep every email password unique.
- Require MFA for email and administrator accounts.
- Review forwarding, filters, delegates, and connected apps periodically.
- Train staff to verify payment-detail changes outside email.
- Keep recovery information current and remove former devices or workers.
- Maintain tested backups for important business information.
Managed computer protection is one layer; it does not automatically secure every cloud mailbox or remove malicious email rules. Email security and Microsoft 365 or Google Workspace backup are separate services unless a selected package expressly includes them.
User Friendly Security helps households and small businesses build understandable layers around computers, accounts, and recovery. Compare our managed computer protection plans, then confirm which optional account, email, or backup services fit your environment. No security measure can prevent every compromise.