Email, cloud & backup
Why a hacker would create rules in your mailbox, and how to check
When someone breaks into a business mailbox, one of the first things they often do is add a rule. A rule can quietly forward copies of your email to them, or hide replies about invoices so you don't notice what's going on. Changing your password doesn't remove it. Here's what to look for.
The short version
The short version
- Attackers add rules to forward, hide or delete email so they can keep watching after you change your password.
- Check rules and forwarding in every mailbox that may have been accessed.
- Remove anything you didn't create, then change the password and sign out all sessions.
- Turn on multi-factor authentication and tell anyone who may have received fake invoices.
How the trick works
Business email compromise usually starts with a stolen password, often from a fake sign-in page. Once inside, the attacker wants to stay hidden and keep access. Mailbox rules help with both.
| Rule the attacker adds | What it does | Why it helps them |
|---|---|---|
| Forward copies to an outside address | Every email, or emails with words like "invoice" or "payment", go to the attacker too | They keep reading your mail even after a password change |
| Move or delete certain messages | Replies from a supplier or bank are moved to an obscure folder or deleted | You don't see the warning that something is wrong |
| Mark as read | New messages look already seen | Less chance you'll notice them |
The attacker can then reply as you, change bank details on an invoice, or ask colleagues for payments. Our guide to invoice and payment redirection scams covers that side.
Signs a mailbox may have been taken over
You might not see the attacker, but you may see the effects:
- Replies to emails you don't remember sending
- Customers or suppliers asking about a changed bank account
- Emails you expected never arriving, or appearing already read
- Sign-in alerts from a place or device you don't recognise
- New rules, filters or forwarding addresses in your settings
- Colleagues receiving odd requests "from you" for payments or gift cards
Any one of these is a reason to check the mailbox properly, even if everything else looks normal.
Where to check
Check every mailbox that may have been accessed, including shared mailboxes.
Outlook and Microsoft 365
- In Outlook on the web, open Settings, then Mail, then Rules. Look for rules you didn't create.
- In the same Mail settings, check Forwarding to see whether all mail is being sent elsewhere.
- Administrators can review every mailbox's rules centrally. Microsoft's guidance on Outlook rules attacks explains the admin tools and what suspicious rules look like.
Gmail and Google Workspace
- In Gmail, open Settings, then See all settings, then Filters and blocked addresses. Delete filters you don't recognise.
- In the Forwarding and POP/IMAP tab, check that mail isn't being forwarded to an unknown address.
Rules can hide in plain sight
Attackers often give rules short or harmless-looking names, like a single full stop. Judge a rule by what it does, not its name.
If you find one
1. Don't just delete it and move on. Take a screenshot first, including the forwarding address. It's useful evidence. 2. Remove the rule and any forwarding. 3. Change the password and choose one you haven't used anywhere else. 4. Sign out all other sessions and check recent sign-in activity. 5. Turn on multi-factor authentication if it isn't already on. See our guide to two-step verification. 6. Check sent items and deleted items for messages you didn't send. 7. Warn people who may have been targeted, such as customers and suppliers who received invoices from you recently. Ask them to confirm any changed payment details by phone. 8. Report it. You can report cybercrime to ReportCyber through the Australian Signals Directorate.
If personal information may have been seen, read our guide to the Notifiable Data Breaches scheme to work out whether you need to notify anyone.
Prevent it next time
- Use multi-factor authentication on every mailbox, ideally an authenticator app or passkey.
- Block or alert on automatic forwarding to outside addresses for the whole organisation.
- Check payment changes by calling a number you already have, never one in the email.
- Review mailbox rules as part of any incident and every time a staff member leaves.
NovaSoft's cybersecurity and business email and cloud services can review your Microsoft 365 or Google Workspace settings and set up forwarding controls.
Common questions
I changed my password. Is the attacker locked out?
Not necessarily. Rules and forwarding keep working after a password change, and an attacker may still have an active session. Remove the rules and sign out all sessions too.
Could a rule have been there for months?
Yes. That's why it's worth checking even if the account seems fine now. Look at when each rule was created if your email service shows it.
Do I need to check every staff mailbox?
Check every mailbox the same person could access, plus any that sent or received suspicious emails. An IT administrator can review rules across the whole organisation at once.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.