Is Someone Quietly Forwarding Our Email? How to Check Microsoft 365 for Hidden Inbox Rules
Updated: 11 hours ago
Short answer: To check whether someone is quietly forwarding your email in Microsoft 365, open Outlook settings and look at two places: your inbox rules and your forwarding setting. Any rule you didn't create, especially one that forwards mail outside the company, deletes messages, or moves them to a folder you never use, is a sign someone else got into the mailbox. Don't just delete it. Tell your IT provider, because a hidden rule usually means the account was taken over, and a password reset alone won't undo everything the attacker set up. Your provider should also check every mailbox and block automatic forwarding to outside addresses.
Why would an attacker set up an inbox rule?
Once someone gets into a mailbox, they want to stay there without being noticed. An inbox rule helps them do that. It can:
Send copies of your mail to them, so they keep reading even if they lose access.
Watch payment threads. A rule can pull out anything mentioning an invoice, payment, or wire, so the attacker can step into a real conversation and swap in new bank details.
Hide the evidence. It can delete or bury replies from the real client, and security alerts, before you ever see them.
How do I check my own mailbox for hidden rules?
Anyone can do this in a few clicks. You don't need to be technical.
Check your inbox rules
In Outlook on the web or new Outlook, select Settings, then Mail, then Rules. In classic Outlook on a desktop, look for Rules, then Manage Rules & Alerts. Read through every rule on the list.
Check your forwarding setting
In Outlook on the web or new Outlook, select Settings, then Mail, then Forwarding. Forwarding should be off unless you turned it on on purpose and know where it goes.
What does a suspicious rule look like?
A name that's blank, one letter, or just punctuation.
Forwarding or redirecting mail to an address outside the company.
Deleting messages, marking them as read, or moving them to a folder you never open.
Keywords like invoice, payment, wire, bank, or payroll.
A rule that targets one client, vendor, or your IT team.
One catch: some rules can be hidden from the normal Outlook view. A clean list on your screen is a good sign, not proof. That's why the company-wide check below matters.
I found one. What now?
Take a screenshot of the rule before you change anything.
Don't reply to any payment thread the rule was touching.
Call your IT provider right away.
Call anyone with a pending payment using a phone number you already know, not one from an email, and confirm the bank details.
After that, the account needs a full cleanup, not just the rule removed. Our post on why a password reset isn't enough after a stolen Microsoft 365 session lays out the order.
What should our IT provider check across the company?
Ask these as yes-or-no questions:
Do you check every mailbox's rules and forwarding, not just the one that looked odd?
Is automatic forwarding to outside addresses blocked, with approved exceptions only?
Does a new forwarding rule raise an alert that someone actually reviews?
Are apps that can read mailboxes limited to ones we approved?
Do admins and people who move money use phishing-resistant sign-in?
If any answer is no or "not sure," that's worth a conversation. The Security Baseline checklist covers the same ground.
Does a password reset get rid of it?
No. An inbox rule stays until someone removes it, and an attacker who set one up often left other ways back in, like their own device or MFA method on the account. The full cleanup order is: revoke sign-in sessions, remove devices and MFA methods you don't recognize, remove rules and forwarding, review app access, then reset the password. We walk through each step in Someone Stole a Microsoft 365 Session: Why a Password Reset Isn't Enough.
For more on how attackers get in to begin with, see device code phishing and fake IT help desk calls. For the sign-in side, see the best phishing-resistant login for small firms. And when staff leave, our Microsoft 365 offboarding checklist includes checking their rules and forwarding.
Attackers also use printed codes to reach staff phones. See our guide to QR code phishing.
Why are firms that move money a target?
A hidden rule is how an attacker sits quietly inside a payment conversation. For wealth managers, law firms with trust accounts, and anyone sending pay apps, one changed bank detail can send money to the wrong place. Always confirm a change by calling a known number. More on that in Is that really your client? and deepfake voice and wire fraud. We work with financial services firms and law firms on exactly this.
How does 24uNet help?
Our identity threat detection and response watches for suspicious sign-ins and new inbox rules, so we can step in. Checking rules and blocking outside forwarding are part of our Security Baseline.
FAQ
How do I know if someone is forwarding my email? Check your inbox rules and forwarding setting in Outlook. A rule or forward you didn't set up is a red flag.
Does changing my password remove a malicious inbox rule? No. The rule stays until someone removes it, and the attacker may have other access too.
Can inbox rules be hidden? Yes. Some rules don't show in the normal Outlook view, so your IT provider should check from the admin side.
Should we block automatic forwarding outside the company? For most small firms, yes, with approved exceptions only.
Why do attackers target payment emails? So they can step into a real conversation and change bank details. Verify any change by calling a known number.
Found something odd?
Reach out to us, call Denver (303) 468-5515 or College Station (979) 256-5100, or email sales@24unet.com. We're happy to talk it through.
References
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. Cyber AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments