Open the mailbox rules for a few key accounts at most companies and you will find a surprise. A rule forwards invoices to a personal address. Another rule copies messages from a manager to an account nobody recognizes. A third rule moves messages about payments to a deleted folder so the owner never sees them.
These rules take a minute to create. They can run for months without anyone noticing.
What a forwarding rule actually does
A mailbox rule runs on every new message that matches its conditions. It can forward a message to another address, redirect it without a copy in the sent folder, move it to a folder, mark it as read, or delete it.
Staff create legitimate rules every week. An assistant forwards travel receipts to accounting. A sales manager copies a shared inbox during vacation. Those rules have a business reason and an owner who can explain them.
The risky rules share a pattern. The destination is a personal account or a domain that looks similar to a company domain with one letter changed. The rule covers invoices, payments, payroll, or messages from a specific executive. The mailbox owner does not remember creating it.
Attackers use the same mechanism. After taking over a mailbox, an attacker creates a forwarding rule and watches payment conversations from outside the company. When a real invoice thread arrives, the attacker joins it with new bank details. Finance pays the wrong account because the thread and the names are real.
Where these rules hide
Check three places, because a rule can live in only one of them.
First, check the rules inside the email app itself. Look for forwarding, redirect, and auto delete actions, and look for rules with generic names such as a single period, a space, or the word "update."
Second, check the mailbox settings in the web version of your email system. Forwarding to an external address can be set at the mailbox level, separate from any rule staff see in the desktop app.
Third, check the admin settings for the whole tenant. An administrator can allow or block automatic forwarding to outside domains at the organization level. If that setting allows external forwarding, every mailbox inherits the risk.
Departing employees create a related problem. A staff member who forwards work mail to a personal account during their last weeks takes customer threads and price lists with them. The forwarding stops when the mailbox is deleted. The copies already sent remain outside the company.
A one hour audit you can run this week
Start with the accounts that handle money and sensitive information: finance, payroll, human resources, executives, and shared mailboxes for accounts payable and accounts receivable.
For each account, list every rule. Record the name, conditions, action, and destination. Ask the owner to confirm each rule in writing. Remove any rule the owner cannot explain.
Then check all mailboxes for two patterns: any rule that forwards to an address outside your company domains, and any rule that deletes or moves messages about payments, invoices, or password resets.
Turn off automatic external forwarding at the tenant level. Create an exception process for the rare cases that need it, with a named owner and an expiration date.
Add rule creation to your security alerts. Most email platforms can alert an administrator when a user creates a new forwarding rule. That alert turns a hidden change into a ticket someone reviews the same day.
Put the check on a schedule
Add this review to your quarterly access review. When you check who has access to files and applications, check mailbox rules for the same sensitive accounts. When an employee leaves, include mailbox rules and mailbox level forwarding in the offboarding checklist.
Keep the output short. Leadership needs three numbers: how many mailboxes were checked, how many external forwarding rules were found, and how many were removed.
Start with finance and executives this week. Export the rules, confirm each one with its owner, and remove the ones nobody can explain. The work takes about an hour for the first group.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It's the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.