Your Email Forwarded Without Permission? Here's the Fix

Quick answer for advanced users

Check for mailbox forwarding rules under your email provider's settings, or run Get-Mailbox -Identity you@domain.com | FL ForwardingSMTPAddress in Exchange Online PowerShell. Remove any rule you don't recognize. Then reset your password and force sign-out of all sessions.

I know seeing a forwarding rule you never set is stomach-churning. It happened to my cousin two years ago—someone set up a rule forwarding all her invoices to a random Gmail address. She only noticed when clients started asking why she hadn't replied. The scam is simple: an attacker phishes your password, logs in, creates a rule to forward every email with keywords like 'invoice', 'password', or 'reset' to their address, then deletes the original so you never see the reply. Here's how to rip it out and stop it from coming back.

Remove the forwarding rule

1. Gmail: Go to Settings (gear icon) → See all settings → Forwarding and POP/IMAP tab. Under Forwarding, you'll see any forwarding address listed. Click 'Disable forwarding.' If you see an address you don't recognize, delete it.
2. Outlook.com / Hotmail: Go to Settings → View all Outlook settings → Mail → Forwarding. Turn off 'Enable forwarding.' Click 'Save.'
3. Office 365 / Exchange Online: Log into Exchange Admin Center → Recipients → Mailboxes. Select your mailbox, click Mailbox features → Mailbox features → Mail flow → 'View details.' Remove the forwarding address under 'Forwarding.'
4. iCloud Mail: Go to iCloud.com → Mail → Settings (gear) → Preferences → Forwarding. Delete any unknown address.
5. Yahoo Mail: Go to Settings → More Settings → Mailboxes → Forwarding. Remove the address.
6. Any custom domain or IMAP provider: Check if there's a forwarding rule in your webmail interface or contact your hosting support. Some providers (like Namecheap Private Email) hide this under 'Email Forwarding' separate from inbox rules.

Check for inbox rules that forward instead

Some attackers are sneakier—they don't use the forwarding feature. Instead, they create an inbox rule that forwards specific emails. In Gmail, this shows as a filter under Settings → Filters and Blocked Addresses. In Outlook on the web, go to Settings → Mail → Rules. Look for any rule you didn't create, especially one moving messages to an external address. I've seen rules named 'Meeting room booking' that forward all 'urgent' emails to a compromised account. Delete any rule you didn't set.

If removing the rule doesn't stop it

Sometimes the forwarding rule is hidden deeper. Here's what to try:

Reset your password immediately

Use a strong, unique password you've never used elsewhere. Don't reuse an old one. If your provider supports it, use a 20+ character passphrase like 'CoffeeRainbow42!Firewall'.

Force sign-out of all sessions

After resetting, most providers have a 'Sign out of all sessions' option. Use it. In Gmail, scroll to the bottom of your account security page and click 'Sign out of all other web sessions.' In Office 365, go to Azure AD → Users → your account → 'Revoke sessions.' This boots out the attacker.

Enable two-factor authentication (2FA)

This is non-negotiable now. Use an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) rather than SMS if you can. SMS can be intercepted via SIM swapping. 2FA stops most phishing attacks cold.

Check third-party app access

Attackers often grant themselves access via OAuth apps. In Gmail: Security → Third-party apps with account access. Remove anything you don't recognize. In Office 365: Azure AD → Enterprise applications → your account → 'App registrations.' Remove unknown apps.

Prevention: stop it from happening again

I can't stress this enough: never click links in emails asking you to 'verify your account' or 'reset your password.' Type the URL yourself. Also, set up a rule in your email client that flags any change to forwarding settings. In Office 365, you can create a mailbox audit log that alerts you when a forwarding rule is added. Here's how: in Exchange Admin Center, go to Compliance Management → Audit → Enable mailbox auditing. Then create a rule in Security & Compliance → Alerts → 'Mailbox forwarding rule created.' For Gmail, turn on 2-factor and check your security page weekly. I check mine every Monday morning—takes 2 minutes.

One more thing: if you use a domain email (like you@yourcompany.com), configure SPF, DKIM, and DMARC records. These help prevent your domain from being used in spoofing attacks, but they won't stop a compromised account. Still worth doing.

Final thought: I know this feels invasive. But with a clean password, 2FA on, and a quick weekly check of your email settings, you'll be fine. I've seen hundreds of these cases, and the fix is always the same: find the rule, delete it, lock the door.