Six signs your business email account has been taken over

When most people picture a hacked email account, they picture someone locked out of it. That is rarely how it goes. An intruder with your password usually wants you to keep using the account normally. As long as you do, they can read your mail, wait for an invoice, and send messages from your real address that your customers have every reason to trust.

So the signs are quiet. Here are six worth checking for.

The six signs

1. Messages in “Sent” that you did not write

Open your Sent folder and scroll back a week or two. Look for anything you don’t recognize, especially a “shared document”, a “voicemail”, or a payment request sent to many people at once. An intruder often deletes these afterwards, so also check Deleted and Trash.

2. Forwarding or filter rules you did not create

This is the sign most people miss, and the most important one. A common move is to add a rule that quietly forwards copies of your mail to an outside address. Another rule then moves replies about the fake messages straight to the trash, so you never see a customer asking “did you really send this?”

• Gmail: Settings → See all settings → Filters and Blocked Addresses, and Forwarding and POP/IMAP. These settings are only in Gmail on a computer, not in the phone app.
• Outlook / Microsoft 365: Settings → Mail → Rules, and Forwarding, in Outlook on the web (outlook.office.com).

Any rule you can’t explain should be deleted.

3. Contacts asking about a message you never sent

“Was that really from you?” is often the first sign anyone notices. Take it seriously even if you see nothing unusual in your own mailbox, because of the deleted-items and filter tricks above.

4. Sign-ins from places or devices you don’t recognize

Both major providers show recent activity. In Gmail, the Details link at the bottom right of the inbox lists recent sign-ins; your Google Account’s Security page lists the devices. In Microsoft 365, the Recent activity page at mysignins.microsoft.com does the same. A sign-in from another state or country, or from a device you don’t own, is a red flag.

5. Security alerts or reset codes you did not ask for

A text with a verification code you didn’t request, or an email saying “your password was changed,” means someone is trying, or has succeeded.

6. Your recovery phone or email has changed

An intruder who plans to stay will change the recovery details, so that you can’t reset the password when you finally notice. Check that the backup phone number and email on the account are still yours.

What to do in the first hour

1. From a different, trusted device, change the password to a new one you have never used anywhere else.
2. Sign out of every session. Google calls it “Sign out” under Your devices; Microsoft has “Sign out everywhere” in your account’s security settings.
3. Delete any forwarding and filter rules you did not create.
4. Remove connected apps you don’t recognize. An app you granted access to can keep reading mail after the password changes.
5. Turn on two-step verification, preferably with an authenticator app rather than text messages.
6. Tell the people who received anything odd, by phone or text rather than from the same inbox.
7. Check anything that uses this address to reset a password (bank, payroll, domain registrar, website). Whoever read your email could have reset those too.

The order matters. Changing the password without step 3 leaves the forwarding rule in place, and whoever set it up keeps reading your mail anyway.

Getting a second pair of eyes

If you run a small office in or near Rappahannock County, Virginia, I’ll go through your accounts and mail setup with you for free and leave you a one-page report. Here is how the free email check works.