Mailbox Rules and Forwarding: The Quiet Half of a BEC Compromise

Business email compromise is usually described by its ending: a fraudulent payment. The part that makes that ending possible is quieter. Once someone controls a mailbox, they often try to keep the real owner from noticing what is happening, and mailbox rules and forwarding are common tools for doing it.

This article is about finding those footholds, and about what to do when you do.

Why rules and forwarding matter

A rule is stored in the mailbox itself. It can keep working after the attacker has logged out, and a password reset on its own does not necessarily remove it. A forwarding setting works the same way: a copy of incoming mail can keep flowing to an outside address until someone looks for it.

In a payment-fraud chain, that gives an attacker useful options:

Watch quietly. Copies of invoice and payment threads go to an outside address, so the attacker can study how the business writes and approves payments.
Hide the replies. A rule can move or delete messages that mention a payment or a particular contact, so the mailbox owner may not see the reply to a fraudulent request.
Stay out of sight. Messages moved to rarely opened folders are easy to miss.

What public guidance says to look for

Microsoft’s public guidance on responding to a compromised email account lists common symptoms. Several of them concern rules and forwarding:

Rules that automatically forward email to unknown addresses.
Rules that move messages to folders such as Notes, Junk Email or RSS Subscriptions.
Recently added external email forwarding.
Suspicious messages in Sent Items or Deleted Items.
Unexpected changes to the user’s contact details in the address list.

The same guidance points out that you should review inbox rules including hidden ones, and check both internal and external forwarding settings on the mailbox. A quick look at the Rules screen in Outlook is not a full review.

Habits that help you catch it sooner

Alert on new rules. Flag newly created inbox rules that forward, redirect or delete mail, and any new external forwarding.
Limit automatic external forwarding. If the business has no need for it, restrict it by policy so a single rule cannot send mail outside.
Check your logging. Verify that auditing and the Unified Audit Log are on and that retention is long enough to look back across a whole incident.
Ask staff to report oddities. A reply that never arrived, or a message that vanished from the inbox, is worth a quick message to IT.
Review sign-in activity. Unfamiliar locations or devices, and newly registered MFA methods, often sit alongside a malicious rule.

If you find a suspicious rule

Treat it as a sign that someone else has had access, and start containing right away:

1. Disable the account, or reset the password if you cannot. Do not send the new password to the user by email, since the attacker may be reading that mailbox.

2. Revoke active sessions and refresh tokens so existing access stops working.

3. Review registered MFA methods and devices, and remove any you do not recognize.

4. Review applications that were granted consent, and revoke the ones that should not be there.

5. Remove the suspicious rules and forwarding, and check administrative roles for changes.

Evidence capture runs in parallel with these steps rather than ahead of them. Record the rule details and export the relevant audit log entries as you go, but do not leave the account open while you do.

Then work backwards. Use the audit logs from the first sign of suspicious activity to see what was read, sent, moved or forwarded. Compare that window against recent payment changes and outgoing payments, and let your finance team know quickly so they can ask the bank about anything that looks wrong. Recall requests tend to work better when made quickly.

The takeaway

A convincing fraudulent email is the visible part of BEC. A rule or forwarding setting that nobody on your team created is often the evidence of how it was set up. Looking for it early gives you a better chance of catching the problem before money moves.

If you want help reviewing a mailbox you are worried about, see our BEC and Microsoft 365 investigation service.