Ransomware gets the headlines. The quiet rule that forwards your email to an attacker usually does not.
Email forwarding rules are automatic instructions inside your mailbox that say, “when a message arrives, send a copy somewhere else or move it to a specific folder.” They are useful for sharing a mailbox or keeping things organized, but once an attacker is inside an account, those same rules can quietly send your business email straight to their inbox.
After a hacker gets into a mailbox, they do not always lock the account or send obvious spam. Sometimes they create a simple forwarding rule that sends copies of emails to an outside address or hides certain messages from the user. Email keeps “working,” so nobody notices while the attacker silently watches conversations and waits for the perfect moment to strike.
This is how they learn who approves invoices, how payments are made, and which vendors you trust. Then they step in with convincing fraud: fake invoices, altered wire instructions, or poisoned links that look like part of an ongoing thread.
Here is what to remember:
- Treat forwarding rules as high risk, not a minor setting.
Any rule that sends mail outside your organization or automatically moves important messages should be reviewed and approved, not created casually. - Regularly review rules for each mailbox.
Make it a habit to check inbox rules for finance, HR, leadership, and shared mailboxes. Look for anything you do not recognize, especially rules that forward or delete messages. - Limit auto forwarding to external addresses.
Where possible, block or restrict automatic forwarding outside the domain, and use shared mailboxes or groups instead of personal rules to distribute mail. - Train staff to report “weird email behavior.”
If someone notices missing messages, strange folder activity, or replies they never saw the original for, that can be a sign of malicious rules, not just a glitch.
At SkyViewTek, we help your business lock down these overlooked settings, review critical mailboxes, and catch hidden forwarding rules before they turn into invoice fraud or data theft. One quiet rule should never be the reason money or client information walks out the door. Reach out to Bernie Orglmeister at support@skyviewtek.com or call 610 590 5006.