Check your mailbox for forwarding rules
After a mailbox is broken into, attackers often leave a quiet forwarding rule. Changing the password doesn’t remove it.
When an email account is compromised, the attacker usually does two things before leaving: sets up a rule that forwards copies of mail somewhere else, and sometimes another that hides replies about invoices or payments. Then they wait.
The password gets changed and everyone relaxes. The rule keeps running.
Check yours, and check your company’s:
- In Outlook or Gmail settings, look at rules, filters and forwarding. Delete anything you didn’t create.
- Look for rules that move mail to RSS, Archive or Deleted folders. That’s a classic hiding trick.
- Admins: block automatic forwarding to outside addresses by default, and allow exceptions by request.
- After any account compromise, review rules, connected apps and recovery details, not just the password.
Most invoice fraud I’ve seen started with a rule like this, set up weeks before the fake invoice arrived.