A hidden inbox forwarding rule is one of the most persistent tactics used in business email compromise. After gaining access to an account, an attacker sets up a rule that silently forwards incoming emails — or specific categories of emails — to an address they control. Even after you change your password, the rule continues to operate. This guide explains what to look for and how to remove it safely.
Where attackers hide persistence
Email forwarding rules are typically set at the server level, meaning they run even when you are not logged in and even if you are using a different device. They are separate from any settings on your phone or laptop. This is why changing your password alone does not stop a forwarding rule — the rule is stored on the email server and continues executing until explicitly deleted.
Attackers often configure forwarding rules to be selective rather than to forward everything. A rule that forwards every email would quickly become obvious — you might notice the external address in your sent items, or the destination inbox would fill rapidly. More sophisticated rules target only specific senders (your bank, your accountant, specific suppliers) or subject-line keywords (invoice, payment, transfer, confirmation). This lets the attacker monitor financially relevant correspondence while remaining invisible.
Some attackers also set rules that move certain incoming emails to Deleted Items or to a hidden subfolder automatically, preventing you from seeing them in your main inbox. This is particularly common in attacks that are building up to invoice fraud — the attacker hides the legitimate invoice notification while preparing to send a fake one.
What to check in Microsoft 365 and Google Workspace
In Google Workspace, go to Gmail → Settings → See all settings → Filters and Blocked Addresses, and also check Forwarding and POP/IMAP for any forwarding addresses you did not set. Rules set via Google Apps Script or third-party integrations may not appear in the standard settings view — check the security dashboard in your Google Account for any third-party apps with access to Gmail.
In Microsoft 365, the inbox rules set by attackers are often not visible in the standard Outlook settings view on a desktop client — they may have been set via Exchange transport rules or via Outlook Web Access in a way that only appears in the Exchange Admin Centre or through PowerShell. If you suspect compromise, ask your IT provider to run a PowerShell query against your mailbox to list all inbox rules: Get-InboxRule -Mailbox [email protected] will return all rules including those not visible in the standard UI.
How to preserve evidence before deletion
Before deleting a suspicious forwarding rule, take a screenshot and record the destination address (where email was being forwarded to), the rule conditions (what emails it targeted), and the rule name if it has one. This information is useful if you need to report the incident to your bank, a security professional, or Scamwatch, and it helps establish the scope of what may have been forwarded.
After deleting the rule, check your email account's sign-in history for any access you did not initiate, change your password, enable MFA if not already active, and revoke any active sessions other than your own devices. The forwarding rule is a symptom — the underlying access method (a compromised password, a phishing link, or a leaked credential) also needs to be addressed.
- Check Gmail settings: Settings → Filters and Blocked Addresses, and Forwarding and POP/IMAP.
- In Microsoft 365, use the Exchange Admin Centre or PowerShell to list all inbox rules.
- Look for rules that forward to external addresses, hide emails, or move specific keywords to Deleted Items.
- Screenshot the rule details before deleting — destination address, conditions, and name.
- After removing the rule: change password, enable MFA, and revoke other active sessions.
- Check third-party app connections — revoke any apps with email access you did not authorise.
Hidden forwards can keep leaking email even after a password is changed.
Check email login security