Most small business owners picture an email compromise as a single, visible event: a strange login, a locked-out employee, an obvious ransom note. In practice, the moment that matters most often happens quietly, right after the attacker gets in. Before anything looks wrong, they open the mailbox's rules settings and add one that forwards, copies, or redirects certain messages, often anything mentioning "invoice," "wire," or "password," to an address that has nothing to do with your business. Then they wait, or they don't wait at all, and move straight to the fraud the rule was built to support.
1. A password reset doesn't undo what already happened
The instinct after a suspected compromise is to reset the password and move on, and that instinct isn't wrong, it's just incomplete. A password reset fixes how the attacker got in. It has no effect on anything they configured once they were inside, and a forwarding or inbox rule is exactly the kind of change that keeps operating under the account's own normal permissions. The account can look completely secure, MFA and all, while a rule quietly keeps copying mail to somewhere outside the business.
2. The rule doesn't need the attacker to log back in
Part of what makes this technique effective is that it doesn't depend on repeated access. Once the rule exists, the mail server itself does the work, forwarding or copying matching messages automatically, with no further sign-in required. That means the usual signal small businesses rely on to spot a problem, an unfamiliar login or a strange location in the sign-in log, never fires again after the rule is set. The attacker can disappear entirely and the rule keeps working.
3. Nobody looks there unless something tells them to
Inbox and forwarding rules live in a settings screen that almost no employee or owner opens in the normal course of business. Even IT-literate staff tend to only find one by accident, usually while trying to fix something unrelated. That obscurity is exactly why the technique works as well as it does: it isn't hidden through anything technically sophisticated, it's hidden through being somewhere nobody thinks to look. This is the same reason a hidden rule so often turns up in the middle of a business email compromise investigation rather than before one.
What actually catches it
Treating "the account is secured" and "the mailbox is clean" as two separate questions is the fix. After any suspected compromise, a rule review belongs in the same step as the password reset, not a follow-up someone gets to later, and the same check belongs in every offboarding process so a departing employee's mailbox isn't left quietly forwarding somewhere after they're gone. Managed detection and response with a 24/7 SOC is where this is normally caught early, since it watches for the kind of unusual mailbox configuration change a rule like this represents, rather than relying on someone stumbling across it. Phishing-resistant MFA and multi-factor authentication still matter here too, not because they remove an existing rule, but because they lower the odds of the initial compromise that lets an attacker set one in the first place.
Frequently asked questions
How do I check if a mailbox has a hidden forwarding rule?
In Outlook or Outlook on the web, check the full list of inbox rules under mail settings, not just the ones shown on the main rules screen, since some rule types are hidden from that default view. In Microsoft 365, an administrator can review mailbox forwarding and inbox rules across every account from the admin center rather than checking one mailbox at a time. Look for any rule that forwards, redirects, or silently copies mail to an address you don't recognize, especially rules with no visible name or an intentionally generic one.
Does multi-factor authentication stop this?
MFA makes it harder for an attacker to get into the mailbox in the first place, which is where its value is. It does nothing to a rule an attacker already created before you knew there was a problem. That's why turning on MFA after a suspected compromise has to be paired with a review of existing inbox rules, not treated as a fix on its own.
Would resetting the password alone fix this?
No. A password reset closes the door the attacker walked through. It does not touch anything they set up once inside, including a forwarding rule, which keeps running under the account's own permissions until someone finds it and removes it.
How would a small business even know to look for this?
Most owners never open the inbox rules screen unless something prompts them to, which is exactly why this technique works. A rule check after any suspected compromise, plus routine monitoring that flags unusual mailbox rule activity, is normally handled as part of managed detection and response rather than left for someone to remember to do by hand.
Not sure what's sitting in your mailbox rules right now?
30 minutes with an engineer with DoD infrastructure experience. We'll walk through your Microsoft 365 or Google Workspace setup and show you exactly what a hidden forwarding rule would look like if one were already there.
Book your free assessmentPrefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.