{"id":653,"date":"2026-11-08T08:02:22","date_gmt":"2026-11-08T08:02:22","guid":{"rendered":"https:\/\/mosravo.com\/publications\/?p=653"},"modified":"2026-11-08T08:13:41","modified_gmt":"2026-11-08T08:13:41","slug":"how-to-check-your-email-for-hidden-forwarding-rules","status":"publish","type":"post","link":"https:\/\/mosravo.com\/publications\/2026\/11\/08\/how-to-check-your-email-for-hidden-forwarding-rules\/","title":{"rendered":"How to Check Your Email for Hidden Forwarding Rules"},"content":{"rendered":"

When criminals break into an email account, one of the things they can do is quietly set up forwarding or a hidden rule. Even after you change your password, a copy of every message, including invoices and password-reset emails, can keep flowing to them. This step-by-step guide shows small business owners and everyday users how to check Gmail, Outlook and web-hosting mailboxes for forwarding they did not create, and what to do if they find one.<\/p>\n

Key takeaways<\/h2>\n
\n
Changing your password does not remove forwarding addresses, filters or rules an attacker created.<\/li>\n
In Gmail, check the Forwarding and POP\/IMAP<\/strong>, Filters and Blocked Addresses<\/strong> and Accounts and Import<\/strong> tabs.<\/li>\n
In new Outlook for Windows, check Settings > Mail > Forwarding<\/strong> and Settings > Mail > Rules<\/strong>.<\/li>\n
Web host DreamHost\u2019s October breach advice told customers to review webmail forwarding rules and filters, a good habit for every business mailbox.<\/li>\n<\/ul>\n
Why this matters right now<\/h2>\n
Hosting provider DreamHost disclosed in late October that an attacker had broken into its web-based File Manager and reached some webmail systems, obtaining login details for a limited number of webmail users. Among its advice to affected customers was to check webmail forwarding rules and filters for anything they did not create. The same advice applies after any phishing incident, suspicious login alert or password leak. A hidden rule is a useful tool in invoice and payment fraud, because it lets criminals watch conversations and step in at the moment money changes hands.<\/p>\n
What you need before you start<\/h2>\n
\n
Access to the mailbox in a web browser on a computer, since some settings are easier to find there than in phone apps.<\/li>\n
About 10 minutes per mailbox.<\/li>\n
A list of any forwarding you set up on purpose, such as sending a shared enquiries address to a staff member.<\/li>\n<\/ul>\n
Step by step: checking Gmail<\/h2>\n
Google\u2019s Gmail security tips list the settings to review. In Gmail on the web:<\/p>\n
\n
Click the Settings<\/strong> gear, then See all settings<\/strong>.<\/li>\n
Open the Forwarding and POP\/IMAP<\/strong> tab. Confirm your mail is not being forwarded to an address you do not recognise, and that your POP and IMAP settings are what you expect. If you do not use forwarding, choose Disable forwarding<\/strong> and save.<\/li>\n
Open the Filters and Blocked Addresses<\/strong> tab. Look for any filter with a \u201cForward to\u201d action pointing to an unknown address, and any filter set to \u201cDelete it\u201d that you did not create. A delete filter can hide bank alerts or replies you would otherwise notice.<\/li>\n
Open the Accounts and Import<\/strong> tab. Under Send mail as<\/strong> and Check mail from other accounts<\/strong>, confirm every address belongs to you. Under Grant access to your account<\/strong>, make sure no unknown person has been given access.<\/li>\n
Open the General<\/strong> tab and check your signature and vacation responder for changes.<\/li>\n
Finally, run Google\u2019s Security Checkup<\/strong> to review recovery options, 2-Step Verification and account permissions.<\/li>\n<\/ol>\n
Step by step: checking new Outlook for Windows<\/h2>\n
\n
Select Settings<\/strong> (the gear icon), then Mail<\/strong>, then Forwarding<\/strong>. If Enable forwarding<\/strong> is switched on and you did not set it, turn it off and save.<\/li>\n
Go to Settings > Mail > Rules<\/strong>. Read each rule carefully. Watch for rules that forward or redirect messages, move them to folders you rarely open, mark them as read, or delete them.<\/li>\n
To remove a suspicious rule, select More actions<\/strong> (the three dots) next to it, then Delete rule<\/strong>. Microsoft notes you can also use the toggle beside a rule to switch it off without deleting it, which is handy if you want to keep it as evidence while you investigate.<\/li>\n<\/ol>\n
Classic Outlook on Windows<\/h3>\n
In the classic desktop app, rules are under Home > Rules > Manage Rules & Alerts<\/strong>, on the Email Rules<\/strong> tab. Check each account listed under Apply changes to this folder<\/strong>, because each mailbox has its own rules.<\/p>\n
Step by step: hosting webmail and control-panel mailboxes<\/h2>\n
Many small businesses use email that comes with their web hosting, accessed through webmail or a hosting control panel. Menus differ between providers, but the checks are the same:<\/p>\n
\n
Sign in to your hosting control panel and look for sections named Forwarders<\/strong>, Email routing<\/strong> or similar. Remove any forwarder you did not create.<\/li>\n
Sign in to webmail, open its settings and look for Filters<\/strong>, Rules<\/strong> or Forwarding<\/strong>. Remove unfamiliar entries.<\/li>\n
Check for auto-replies you did not set.<\/li>\n
If you use an email app such as Outlook or Thunderbird with this mailbox, update the saved password there after changing it, as DreamHost advised its customers.<\/li>\n<\/ol>\n
If you find something suspicious<\/h2>\n
\n
Take screenshots<\/strong> of the rule or forwarding address before removing it.<\/li>\n
Remove<\/strong> the forwarding address, filter or rule.<\/li>\n
Change the password<\/strong> to a strong, unique one, and change it anywhere else you reused it.<\/li>\n
Turn on two-step verification<\/strong> if it is not already on.<\/li>\n
Sign out other sessions<\/strong> from your account security settings.<\/li>\n
Warn your contacts<\/strong>, especially customers and suppliers you exchange invoices with, and tell them to confirm any change in bank details by phone.<\/li>\n
Check your sent and deleted folders<\/strong> for messages you did not send.<\/li>\n
For a business mailbox, tell your IT provider, and if customer data may have been exposed, seek advice on your obligations under the Nigeria Data Protection Act.<\/li>\n<\/ol>\n
Troubleshooting<\/h2>\n
\n
I cannot find the Rules option in new Outlook for my Gmail or Yahoo account.<\/strong> Microsoft says new Outlook does not support rules for third-party accounts, so check those mailboxes in their own web settings.<\/li>\n
A rule keeps coming back.<\/strong> Someone may still have access. Change the password again, sign out all sessions and check for unknown apps or people with access.<\/li>\n
Staff use a shared mailbox.<\/strong> Ask the account administrator to review it, since shared mailboxes can have rules too.<\/li>\n<\/ul>\n
Monthly checklist<\/h2>\n
\n
Forwarding settings reviewed on every business mailbox.<\/li>\n
Filters and rules reviewed; unknown ones removed.<\/li>\n
\u201cSend mail as\u201d and account access lists checked.<\/li>\n
Two-step verification confirmed on.<\/li>\n
Recovery phone number and email up to date.<\/li>\n<\/ul>\n
Sources<\/h3>\n
\n
Google: Gmail security tips<\/a><\/li>\n
Microsoft: Set up rules in Outlook<\/a><\/li>\n
Microsoft: Turn on automatic forwarding in Outlook<\/a><\/li>\n
DreamHost: October security incident<\/a><\/li>\n<\/ul>\n
Featured image: Photo: \u201cFree woman\u2019s hands typing laptop\u201d by unknown, CC CC0 1.0, via Openverse \u2014 source<\/a><\/small><\/p>\n<\/body>","protected":false},"excerpt":{"rendered":"
Hackers often set up hidden forwarding or inbox rules that survive a password change. This step-by-step guide shows how to find and remove them in Gmail, Outlook and hosting webmail.<\/p>\n","protected":false},"author":1,"featured_media":657,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[5,4],"tags":[410,277,223,408,409],"class_list":["post-653","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-software","tag-account-takeover","tag-business-email-compromise","tag-email-security","tag-gmail","tag-outlook"],"jetpack_featured_media_url":"https:\/\/mosravo.com\/publications\/wp-content\/uploads\/2026\/11\/emailforwarding.png","_links":{"self":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/653","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/comments?post=653"}],"version-history":[{"count":2,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/653\/revisions"}],"predecessor-version":[{"id":658,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/posts\/653\/revisions\/658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/media\/657"}],"wp:attachment":[{"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/media?parent=653"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/categories?post=653"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mosravo.com\/publications\/wp-json\/wp\/v2\/tags?post=653"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Classic Outlook on Windows<\/h3>\nIn the classic desktop app, rules are under Home > Rules > Manage Rules & Alerts<\/strong>, on the Email Rules<\/strong> tab. Check each account listed under Apply changes to this folder<\/strong>, because each mailbox has its own rules.<\/p>\n

Classic Outlook on Windows<\/h3>\n
In the classic desktop app, rules are under Home > Rules > Manage Rules & Alerts<\/strong>, on the Email Rules<\/strong> tab. Check each account listed under Apply changes to this folder<\/strong>, because each mailbox has its own rules.<\/p>\n