The Inbox Rule You Never Wrote: A Twenty-Minute Sweep for Quiet Forwarding

Most phishing training tells people to look for the badly spelled email. That is fine as far as it goes. The more expensive problem is what happens after someone clicks. The attacker logs in, creates a rule, and then goes quiet. From that point on, your mailbox is doing the attacker's admin for them: invoices get copied out, payment threads get filed away, and replies get marked as read so nobody spots the gap. Business email compromise is less a break-in than a change of address form, and the inbox rule is often the only physical evidence left behind.

For a small UK team, that evidence is worth hunting for. You do not need a security operations centre. You need twenty minutes, admin access to your mail platform, and a slightly suspicious mind.

Why a silent forward is worse than a stolen password

A password can be reset. A forwarding rule can sit there for months, quietly copying every message that mentions an invoice, a remittance, or a change of bank details. The attacker does not need to log in again. They just read the copies.

This is the engine behind a lot of invoice redirection fraud. A supplier emails to say their bank details have changed. The message looks genuine because it is genuine, or because it came from a mailbox the attacker already controls. The accounts team pays the new account. By the time anyone rings the supplier, the money has moved. Rules that move payment threads to an archive folder, or mark them as read, buy the attacker extra days.

Small organisations are vulnerable for a dull reason: the person who administers email is often the same person who pays the invoices, handles HR, and covers reception when someone is off. There is no separation of duties to catch the oddity. The rule is the oddity. You just have to look.

Microsoft 365: where the rules hide

Start in the Exchange admin centre. Check three places, not one.

1. Organisation-wide transport rules. Go to Mail flow > Rules. These apply across the tenant and can redirect or copy mail. Most small teams have none or a handful. Read every one.
2. Per-mailbox inbox rules. Go to Recipients > Mailboxes, pick a mailbox, then look under Mailbox and Organize email. This is where a compromised account usually leaves its mark.
3. Mailbox forwarding. On the same mailbox page, check the forwarding address and whether mail is being delivered to both the mailbox and the forward. Attackers often add this instead of a rule because it is simpler.

If you prefer PowerShell, this is quicker across a larger tenant:

Get-Mailbox -ResultSize Unlimited | Get-InboxRule | Where-Object { $_.ForwardTo -or $_.RedirectTo -or $_.ForwardAsAttachmentTo } | Format-List Name,Identity,ForwardTo,RedirectTo,ForwardAsAttachmentTo,Enabled

And this catches mailbox-level forwarding:

Get-Mailbox -ResultSize Unlimited | Select-Object Name,ForwardingAddress,DeliverToMailboxAndForward

Do not check only the managing director's mailbox. Attackers like accounts payable, sales, and shared mailboxes. Shared mailboxes are especially attractive because they often have no interactive sign-in and no multi-factor prompt to trip over.

Google Workspace: the same hunt, different labels

In Google Workspace, the admin console and the user's own Gmail settings both matter.

• In the admin console, go to Apps > Google Workspace > Gmail > Compliance. Check forwarding and routing settings that apply across the organisation.
• For individual users, open Gmail settings as that user, then look at Forwarding and POP/IMAP, and Filters and Blocked Addresses. A filter that forwards or deletes is just an inbox rule with a different name.
• Check delegates under Gmail settings > Accounts > Grant access to your account. A delegate can read and send mail without ever knowing the password.
• Use the Gmail audit log in Reports > Audit and investigation to see recent filter or forwarding changes. Filter for settings events around the dates that worry you.

If your edition exposes it, turn off automatic forwarding to external addresses unless there is a documented business need. The setting lives under Apps > Google Workspace > Gmail > End User Access in many editions. The exact label varies, so look for Allow users to automatically forward incoming email.

The tells of a rule you did not write

A hostile rule is rarely subtle once you are staring at it. Look for:

• A forwarding address on a domain you do not recognise, especially a lookalike of your own domain or a free webmail address.
• A rule name made of a single dot, a space, or a random letter. Attackers use names that sink to the bottom of a list or look like formatting debris.
• Rules that mark messages as read and move them to Archive, RSS Subscriptions, or a folder you have never used.
• Rules triggered by words such as invoice, payment, remittance, bank details, HMRC, or the name of your finance director.
• Rules created outside working hours, or while the mailbox owner was on leave.
• A rule that forwards to an address which is also a delegate on the mailbox. That combination is a strong signal.

Write down what you find before you delete anything. A screenshot and a date are useful if the matter later becomes an insurance claim or a police report.

Lock the door behind you

Finding a bad rule is only half the job. The other half is making the next one harder to create.

In Microsoft 365, block automatic external forwarding by default in Exchange admin centre under Mail flow > Remote domains > Default. Clear the box labelled Allow automatic forwarding. If a team genuinely needs external forwarding, allow it for a named domain rather than reopening the whole tenant.

In Google Workspace, restrict automatic forwarding in the admin console and review who holds admin roles. Fewer admins means fewer accounts worth phishing.

On both platforms, turn on alerts for new inbox rules or mail settings changes. Microsoft Defender for Office 365 can raise an alert when a rule is created; Google Workspace Alert Center can do something similar. Route those alerts to a person, not a shared inbox nobody reads.

Finally, make rule review part of joining, moving, and leaving. When someone leaves, their mailbox rules should go with them. When someone changes role, check what their mailbox is still forwarding.

A quarterly routine you will actually do

Put twenty minutes in the calendar once a quarter. Do it on a dull Tuesday, not during an incident.

1. Export or list every inbox rule and forwarding address.
2. Compare the list with the last review. Anything new needs an owner and a reason.
3. Check delegates and shared mailbox permissions.
4. Search the audit log for rule changes in the last three months.
5. Remove stale rules and forwarding addresses.
6. Note the date, the reviewer, and anything you changed.

If you find a hostile rule, treat it as an incident rather than a cleaning job. Reset the password, revoke active sessions, check sent items and deleted items, and review any payment changes that happened while the rule was live. Report suspicious email to the NCSC's Suspicious Email Reporting Service, and report fraud to Action Fraud.

The one-page checklist

• List all organisation-wide mail flow rules.
• List all per-mailbox inbox rules.
• List all mailbox forwarding addresses.
• List all delegates and shared mailbox permissions.
• Flag any rule forwarding to an external domain.
• Flag any rule that marks mail as read and moves it to Archive or RSS.
• Check rules created outside business hours.
• Disable automatic external forwarding by default.
• Alert on new inbox rule creation.
• Review rules quarterly and after any leaver.

Hand that page to whoever administers email, even if that person is also the office manager. Especially if that person is also the office manager.