Is a staff mailbox hacked? The warning signs and what to do in the first hour

How to tell, and the first moves

A business mailbox has probably been taken over if you find inbox rules you did not create, especially ones that forward mail outside the company or move it to an obscure folder, messages in Sent or Deleted Items you did not write, unexplained password resets or lockouts, or clients replying to emails you never sent. If you see any of these, act from a different, trusted device: have your administrator disable the account or reset its password, sign the account out of every session, remove the forwarding rules, and call your bank at once if any payment instructions went out. Then find out how the attacker got in, because a new password alone rarely ends it.

I am Anthony Omini, owner of Cross River Tech in Dallas. With a compromised mailbox, the damage almost always depends on how quickly someone noticed. This guide is written so an office manager can recognize the signs and take the right first steps before help arrives.

Warning signs inside the mailbox

Microsoft's own guidance for Microsoft 365 lists the symptoms below, and they match what I see in practice on both Microsoft 365 and Google Workspace. Attackers want to stay hidden for as long as possible, so many of these are quiet.

• Inbox rules that forward mail to unknown outside addresses
• Rules that move incoming messages to Junk, RSS Subscriptions or another folder nobody opens
• Suspicious messages in Sent Items or Deleted Items, often asking someone to pay or open a link
• Missing or deleted email you did not remove
• Frequent password changes or unexplained account lockouts
• A changed email signature or contact details you did not edit
• The mailbox suddenly blocked from sending, often because it was used to send spam

Warning signs that arrive from outside

Often the first clue comes from someone else. A client calls to ask why your firm changed its wiring instructions. A vendor asks whether you really meant to update the bank account on file. Colleagues receive a shared document link from a coworker who swears she never sent it. A flood of bounce-back messages appears for emails nobody in the office wrote.

Take every one of these seriously, even if the mailbox looks normal. Attackers commonly read a mailbox for days or weeks, learning who pays whom, before they send a single message. By the time a fake invoice goes out, it can look exactly like the real thing, down to the signature and the thread it replies to.

Your IT provider may also be the one who spots it. A good monitoring setup raises an alert when a mailbox signs in from an unusual location, when a new forwarding rule appears, or when hundreds of messages are deleted at once. If you have never received a call from your provider about any of those, ask whether anyone is watching for them at all.

The first hour, in order

Do these from a device you trust, not the computer that may be infected. If you have an IT provider, call them first and work through the list together. If you do not, this is the order I follow.

• Disable the account, or if you cannot, reset the password to a long, unique one, and do not email the new password to the user.
• Sign the account out of every active session so stolen sign-ins stop working.
• Check for and remove forwarding rules and mailbox forwarding the attacker added.
• Review the sign-in methods registered for multi-factor authentication and remove any device you do not recognize.
• Remove any connected apps or permissions the user did not knowingly grant.
• If any payment or banking instructions were sent, call the bank immediately.
• Warn staff and key clients by phone not to act on recent emails from that address until you confirm them.

If money moved, call the bank first

Business email compromise exists to redirect money. The FBI's Internet Crime Complaint Center describes it as a scam aimed at businesses and individuals transferring funds, and its advice to victims is to contact the originating bank as quickly as possible and ask for a recall or reversal, because acting fast may reduce or eliminate the loss. It also asks victims to file a complaint at ic3.gov with the banking details included.

In practice that means the phone call to the bank comes before the IT cleanup if a wire or payment went out. Everything else can wait thirty minutes. The money may not. Have the date, amount, receiving bank and account number in front of you when you call, and write down the name of the person you spoke with and what they agreed to do. Those details also go into the complaint and, if you have a policy, the insurance claim.

Why a new password does not end it

Resetting the password feels like the fix, and it is only the start. Microsoft's guidance warns that app passwords are not revoked automatically by a password reset, and attackers often leave other ways back in: an extra phone registered for multi-factor sign-in, a connected app with permission to read mail, a forwarding rule that keeps copying messages out, or administrator rights granted to the account. Each of those survives a password change.

After the account is secured, the sign-in logs show where and when the attacker signed in, and the sent mail during that window shows who received what. That review tells you how far it went, which clients to warn, and whether other accounts were touched. It is careful work, and it is the part most offices skip.

Who else may need to know

If the mailbox held client, patient or policyholder information, the incident may carry legal duties. The FTC notes that every state has a data breach notification law, and medical and dental offices may also have HIPAA breach notification obligations. I am not a lawyer, and this is general information: talk to an attorney about what your situation requires, and do it early, because some obligations have deadlines.

If you carry cyber insurance, call the insurer's claims line before you spend money on recovery; many policies expect you to use their process and approved vendors. Check what the policy and your application actually say, and if you are renewing soon, read my guide to the IT questions on a cyber insurance application.

How mailboxes get taken over

Most compromises I see start with one of three things. A staff member enters their password on a convincing fake sign-in page. A password reused on another website leaks and gets tried against the work account. Or multi-factor authentication was never turned on, so a stolen password is all an attacker needs. Older mail apps that use legacy sign-in methods can also let attackers around multi-factor sign-in if those methods are still allowed.

None of this means your staff were careless. Phishing pages today are good. The job of the setup is to make sure one mistake does not hand over the whole mailbox.

A payment rule that stops most of the damage

Technology catches a lot, but the cheapest protection against business email compromise is a habit. Any office that pays vendors by wire or ACH, or tells clients where to send money, is worth an attacker's patience, and the fake request will look real. The rule I give every client is simple: no change to payment details and no urgent transfer is ever approved on the strength of an email alone.

Write the rule down, tell every person who touches money, and make it safe to slow down. An assistant who phones the managing partner to confirm a wire request should be thanked, not hurried. The FBI's complaint center gives similar advice: confirm any change to account information with the real person through a separate channel, and check the full sender address, especially on a phone where only the display name shows.

• Confirm every new or changed bank account by calling a number you already have on file, never one in the email.
• Treat urgency, secrecy and a new account as a warning, especially together.
• Require a second person to approve transfers above an amount you set.
• Show full sender addresses in email apps on office computers and phones.
• Review bank accounts regularly for payments or deposits that do not match.

Setting up so the next one is caught in hours

For our managed clients, every email account requires multi-factor authentication, legacy sign-in methods are switched off, and incoming mail passes spam and phishing filtering that checks links and attachments. We publish SPF, DKIM and DMARC records for the domain so criminals have a harder time sending mail that pretends to be you. Alerts fire on new forwarding rules, unusual sign-ins and mass deletions, which is how a compromised mailbox gets caught within hours instead of weeks. Mailboxes are also backed up outside the platform, for reasons I explain in why Microsoft 365 is not a backup.

If you are setting up email for the first time or thinking of switching platforms, both major services can be secured to the same standard; my comparison of Microsoft 365 and Google Workspace covers how. And if you think a mailbox in your office is compromised right now, call. Remote support is available around the clock across Texas, with on-site help across Dallas–Fort Worth by appointment, at after-hours rates outside business hours, and I would rather hear from you tonight than after the next invoice goes out.

Questions people ask me