Check Hidden Email Forwarding After an Account Break-In
Matthew Leo · Published September 13, 2026 · Guides
You changed the password on a compromised email account, but important messages still disappear or someone seems to know when password-reset emails arrive. The intruder may no longer need to sign in. A forwarding address, inbox rule or delegate can keep sending copies after the original breach.
Treat this as an account-recovery job, not a spam-cleanup job. Use a device you trust, then work through the settings systematically.
Secure the account before editing mail rules
- Change the email password to a unique one.
- Sign out unfamiliar devices and sessions.
- Check the recovery phone number, recovery email and alternate addresses.
- Turn on two-step verification or a passkey.
- Change reused passwords on other services, especially banking and social accounts.
Google's official compromised-account checklist specifically tells users to remove unfamiliar Gmail labels, filters and forwarding rules. A password change is necessary, but it does not prove those settings were removed.
Check Gmail on a computer
Open Gmail, select the gear icon, then See all settings. Review these areas:
- Forwarding and POP/IMAP: Remove any forwarding address you do not recognize. Check whether POP or IMAP access was enabled unexpectedly.
- Filters and Blocked Addresses: Look for filters that forward, delete, archive, mark as read or skip the inbox. Attackers often target messages from banks, stores or security teams.
- Accounts and Import: Review “Send mail as,” “Check mail from other accounts” and delegated access.
Google documents normal automatic forwarding, including forwarding only messages matched by a filter. That is why checking the main forwarding switch alone is insufficient.
Check Outlook.com
Open Outlook on the web, select Settings, then Mail. Check both Forwarding and Rules. Microsoft notes that forwarding can be configured directly, while a rule can redirect selected messages and make replies behave differently. Remove anything you did not create.
Then inspect connected accounts, automatic replies, blocked senders and recent Microsoft-account activity. Microsoft's forwarding instructions show where the primary control lives, but malicious routing can also be hidden in individual rules.
Search for evidence before deleting everything
Take screenshots or record unfamiliar addresses and rule names before removal. Search Sent, Deleted, Archive and Trash for activity you did not perform. Also search for security notices, password resets, purchases and account-change confirmations. An attacker may have created a rule that marks these messages as read or deletes them.
If the mailbox belongs to an employer or school, contact the administrator. Organization-wide forwarding and retention controls may not be visible to an ordinary user, and administrators can preserve logs.
Do not overlook app access
An intruder may have authorized a mail app, automation service or browser extension instead of creating a visible forwarding rule. Review third-party apps connected to the Google or Microsoft account and remove access you cannot explain. Check app passwords too; older mail clients and scanners may use these separate credentials, and changing the main password does not always communicate which integrations remain trusted.
Do not remove a workplace integration merely because its name is unfamiliar. Record it and ask the administrator first. Payroll systems, customer-support tools and automated scanners may legitimately use delegated mail access.
Verify the repair
- Send test messages from another account using both an ordinary subject and a security-related subject.
- Confirm they remain in the inbox and are not automatically marked as read.
- Recheck recent sign-ins after 24 hours.
- Review important accounts that use this address for recovery.
Pay special attention to financial accounts. Email access can be used to reset passwords, hide purchase alerts or intercept verification links. If you find evidence that those messages were redirected, contact the affected provider through its official app or website and review transactions. Do not use a phone number found inside a suspicious message.
Add the final recovery details to an offline plan such as Mapletechie's account recovery kit. The goal is not merely to regain access. It is to remove every quiet path the intruder left behind.
Tags: email security, Gmail, Outlook, account recovery, phishing