To find and remove malicious email forwarding rules, check both the mailbox’s inbox rules and its separate forwarding settings. Then secure the account and review activity before assuming the issue is resolved. An attacker may use a rule to copy messages, hide them, or keep watching a conversation after an account is compromised.
If you suspect active access, involve the person who manages your email system. Avoid making changes that could erase useful details before recording what you find.
Start by preserving what you find
Before deleting a suspicious rule, record its name, conditions, actions, destination address, and whether it is enabled. Save a screenshot or other appropriate record, along with the time you found it. Note which mailbox is affected and any messages that appear to have been moved, marked as read, deleted, or forwarded.
Do not open or forward suspicious messages unnecessarily. If the account is actively sending or redirecting sensitive mail, containment may need to happen right away. Ask your email administrator to preserve relevant audit and message-tracking information as part of the response.
Check every place email can be forwarded
Inbox rules are only one possible route. Look for rules that redirect or forward mail, mailbox-level forwarding settings, and any organization-wide mail-flow rules your administrator can manage. Also review filters, delegates, connected apps, and other mailbox access that could expose messages.
Microsoft 365
In Outlook on the web, open Settings, then Mail, then Rules. Review each rule, including its conditions and actions. Be cautious of rules that send messages to an unfamiliar address, move messages out of the inbox, delete them, or mark them as read. A rule may be suspicious even if it does not forward mail.
Also check Settings, Mail, then Forwarding. If forwarding is enabled to an address the mailbox owner did not authorize, record the setting and destination before disabling it. Menu names can vary with the Outlook version and organization configuration.
Ask your Microsoft 365 administrator to check for organization-wide mail-flow rules and review available audit and message-trace information. Microsoft’s guidance on suspicious email forwarding activity can help administrators assess an alert and its context.
Google Workspace and Gmail
In Gmail, open Settings and choose See all settings. Review Forwarding and POP/IMAP for an unfamiliar forwarding address, then check Filters and blocked addresses for filters that forward, archive, delete, or mark messages as read. Remove or disable settings the account owner did not create.
For a business account managed through Google Workspace, ask the administrator to review account access and available security or audit information as well. Google’s Gmail security tips provide additional account-security checks.
Look for signs beyond an unknown address
A malicious rule may be designed to keep an attacker informed without making the inbox look obviously different. Watch for rules that:
- Forward or redirect messages to an unfamiliar external or internal address.
- Move specific messages to an unexpected folder, archive them, or delete them.
- Mark messages as read so the owner is less likely to notice them.
- Target messages about payments, account changes, security alerts, or particular people.
- Use broad conditions or names that do not match the rule’s purpose.
Review recent sent, deleted, archived, and forwarded messages where the system makes that possible. Consider whether replies or important notices appear to be missing. If messages involving payments or changed account details may have been intercepted, follow your organization’s verification process through a trusted contact method. For a related response checklist, see what to do when a compromised email account changes bank details.
Remove the setting, then secure the account
After recording the evidence, remove unauthorized rules and forwarding settings. Do this from a device you believe is safe, and coordinate with your administrator if the mailbox is managed centrally. Deleting a rule by itself does not establish that the account is secure.
Next, change the account password and review multifactor authentication. Sign out other active sessions or revoke access where your platform provides those controls. Check recovery email addresses and phone numbers, delegated mailbox access, app passwords, connected applications, and other authorized access. Remove anything the user or administrator cannot verify. Microsoft’s compromised email account response guidance describes further steps for Microsoft 365 environments.
Review sign-in activity for unfamiliar devices, locations, or times, keeping in mind that an unfamiliar entry may need investigation rather than being conclusive on its own. Check whether the account sent unexpected messages or whether new rules appeared after cleanup. If you find evidence that an attacker still has access, continue the response with your email administrator instead of treating the rule removal as the end of the incident.
Check whether other accounts or data were affected
Look for similar forwarding settings and suspicious rules in other mailboxes, especially accounts that share access to sensitive conversations or receive similar business messages. An administrator can review available audit records for rule changes and sign-ins across the organization. The amount of detail available depends on the platform, account setup, and logging configuration. If records do not clearly show who made a change, do not assume the account owner did it.
Consider whether the mailbox contained patient, customer, employee, financial, or legal information. Notify the appropriate people inside your organization and get qualified guidance on any response or notification steps that may apply. Preserve records of the suspected settings and the actions taken.
For broader prevention, review your organization’s business email security practices and make sure staff know how to report unexpected account changes.
Frequently asked questions
How can I tell if someone set up an email-forwarding rule without permission?
Look for an unfamiliar destination, unexpected conditions or actions, or rules that hide messages by moving, deleting, or marking them as read. Compare the setting with what the mailbox owner recognizes, and preserve its details before removing it.
Can malicious rules hide or delete emails without forwarding them?
Yes. Rules can move messages, archive them, delete them, or mark them as read. Check all rule actions and filters, not just settings that name a forwarding address.
How can I tell who created or changed a mailbox rule?
Ask your email administrator to review available audit records. Those records may show rule changes and related account activity, but the detail available depends on the system and its logging configuration.
Is deleting the rule enough to secure a compromised email account?
No. Also secure account access, review sessions and connected apps, check recovery and delegated access, inspect sign-in and message activity, and look for similar settings in other mailboxes.
Next step: If you find unauthorized forwarding or cannot confirm the account is secure, involve your email administrator and preserve the relevant details. Zevonix provides email security and incident response services; you can call (904) 658-0777 to discuss your situation.