Checking Your Email for Hidden Forwarding Rules
After a phishing attack, criminals often add rules that forward, hide or delete your email. How to find malicious forwarding and filter rules and remove them.
When criminals get into an email account, one of the first things they often do is quietly add rules. A forwarding rule sends them copies of your mail. A filter rule hides replies from your bank or your supplier. These rules keep working even after you change your password.
What attackers set up
- Automatic forwarding of all mail to an outside address.
- Filters that forward only messages with words like invoice, payment or password.
- Rules that hide messages by moving them to archive, RSS, junk or a rarely used folder.
- Rules that delete security alerts or replies from a particular contact.
Hidden rules are a key part of business email compromise and vendor email compromise, where attackers watch a conversation and step in at the payment stage.
How to check
- Open your email on a computer and go to the full settings.
- Look at forwarding: is any address listed you did not add?
- Look at filters or rules: read each one. Delete anything you did not create.
- Check the blocked addresses list for contacts you never blocked.
- Check any delegates or shared access to your mailbox.
- Check connected apps and signed-in devices. See sessions and connected apps.
Phone apps often do not show rules. Use the web version on a computer for a full check.
If you find one
- Take a screenshot first, then delete it.
- Change your password and sign out all sessions. See next steps after entering your password.
- Look at what the rule forwarded or hid, and warn anyone affected, such as customers expecting invoices.
- At work, tell your IT team so they can check other mailboxes.
For what to do next and who to tell, see how to report phishing in our complete guide.
Frequently asked questions
Why would a hacker create email rules?
To keep reading your mail after you change your password, and to hide replies or security alerts so you do not notice the attack.
Does changing my password remove forwarding rules?
No. Rules and forwarding stay in place until you delete them, which is why checking is essential.
What does a suspicious rule look like?
Forwarding to an address you do not know, or rules that move or delete messages containing words like invoice, payment, bank or security.
Sources
- Create rules to filter your emails, Gmail Help
- Manage email messages by using rules in Outlook, Microsoft Support
- Recovering a hacked account, UK National Cyber Security Centre
