Locking Down Email Rules to Block Fraudulent Forwarding and Auto-Delete Traps

Email security is more than a strong password. Criminals increasingly rely on silent email rules—forwarding, filtering, and auto-delete traps—to hide password-reset messages, intercept invoices, and siphon one-time codes. These rules live inside your mailbox, so they can survive password changes and look like ordinary automation. This guide shows you how to spot and remove malicious rules, prevent new ones, and set up ongoing monitoring so you’re the one in control.

How Email Rules Become a Backdoor

Email platforms allow rules (also called filters) to organize messages: forward receipts to a finance inbox, label newsletters, or archive certain notifications. Attackers abuse these same features to:

• Auto-forward: Secretly send copies of all messages—or just security emails—to an attacker-controlled address.
• Auto-delete or archive: Hide password-reset links, bank alerts, or sign-in warnings so you never see them.
• Redirect or mark as read: Make critical mail blend in or bypass your attention.
• Persist after password changes: Rules generally aren’t removed when you change your password, making them a durable foothold.

Because these changes don’t require external access once set, your sign-in logs may look normal while the attacker remains “in” via rules.

Quick Triage: Signs You Might Be Affected

• Missing expected emails (password resets, invoices, bank alerts) that were definitely sent.
• Security devices or services report logins you didn’t initiate.
• Friends or colleagues say they received odd replies or forwarding copies you didn’t send.
• Your email client shows “rules changed,” “filter created,” or “forwarding enabled” notices.
• Mailbox storage drops or rises unexpectedly due to hidden deletions or archiving of many messages.

Immediate Containment If You Suspect Rule Abuse

1. Stop active sessions: Sign out other sessions from your account’s security page.
2. Change your password to a unique, long passphrase that is not reused anywhere.
3. Turn on phishing-resistant MFA (authenticator app or passkeys, not SMS when possible).
4. Check and remove malicious rules and forwarding using the platform-specific steps below.
5. Review recovery options: Remove unknown phone numbers, backup emails, or app passwords.
6. Run device checks: Scan your computer and phone for malware; update OS and browsers.

Audit and Lock Down Rules in Popular Email Providers

Gmail (personal accounts)

1. Check filters: Settings (gear) > See all settings > Filters and Blocked Addresses. Remove filters that:
   • Forward, delete, archive, or mark as read messages with terms like “reset,” “security,” “bank,” “verification,” “code,” “invoice.”
   • Apply to broad senders like no-reply@, accounts@, support@, or to entire domains you don’t control.
2. Check forwarding: Settings > Forwarding and POP/IMAP. Remove unknown forwarding addresses and disable “Forward a copy.”
3. Review POP/IMAP and third-party access: Settings > Forwarding and POP/IMAP; disable if unused. Visit Google Account > Security > Third-party access and remove suspicious apps.
4. Search your mailbox: Use queries like: in:anywhere subject:(security OR verification OR code OR reset) newer_than:30d to spot diverted messages.

Outlook.com / Microsoft 365 (consumer and work)

1. Check rules: Settings (gear) > Mail > Rules. Delete rules that forward, redirect, delete, or move security and financial emails.
2. Inbox sweep and categories: Review “Sweep” schedules and category-based moves that could hide alerts.
3. Forwarding: Settings > Mail > Forwarding. Disable unknown forwarding or redirect rules.
4. Connected accounts/add-ins: Settings > Mail > Sync email and Manage add-ins. Remove unknown connections.
5. Admin center (work accounts): If you’re an admin, check mailbox audit logs, mailbox-level forwarding, and transport rules in Exchange Admin Center.

Yahoo Mail

1. Filters: Settings > More Settings > Filters. Remove filters that move or delete important messages.
2. Forwarding: Settings > More Settings > Mailboxes. Select your mailbox and disable unknown forwarding addresses.
3. Security review: Account Info > Recent activity to spot unfamiliar sign-ins.

Apple iCloud Mail

1. Rules (on iCloud.com): Mail > Settings > Rules. Delete suspicious rules that forward or trash messages.
2. Forwarding: Mail > Settings > Forwarding. Disable unknown forwarding addresses.
3. Sign-in and devices: Apple ID > Devices to remove unknown devices and enforce two-factor authentication.

Hardening Checklist: Prevent Rule-Based Takeovers

• Lock down recovery: Use only your primary phone and a private recovery email. Remove old numbers and addresses.
• Use an authenticator or passkeys: These reduce the risk from SIM swaps and some phishing attempts.
• Restrict forwarding: Turn off global forwarding. Only create narrow, purposeful filters you fully understand.
• Name filters clearly: For any legitimate rules you keep, use explicit names like “Newsletters to Read Later – Archive after 30 days.” Suspicious vague names are a red flag.
• Review third-party access quarterly: Remove unused apps, IMAP connections, and legacy “app passwords.”
• Enable account alerts: Turn on notifications for new logins, password changes, and forwarding setup where supported.
• Keep clients updated: Update mail apps and operating systems to reduce exploitation risk.

What Malicious Rules Look Like in Practice

• Keyword traps: If subject contains “verification,” “reset,” “security,” move to Trash or a deep folder like “.System/Receipts.”
• Broad forwarding: Forward all mail to an external address, then delete the original.
• Selective siphoning: Forward messages from banks, payment processors, domain registrars, cloud providers, or “no-reply@” senders to an attacker.
• Time-window filters: Apply only during certain hours to reduce detection.
• Mark-as-read + archive: Quietly removes visual cues of new mail while keeping it searchable.

Business and Shared Mailbox Considerations

• Centralized monitoring: For Microsoft 365 and Google Workspace, enable mailbox auditing and alert on creation of forwarding rules and transport rules.
• Least privilege: Limit who can create organization-wide forwarding or transport rules. Separate admin and user accounts.
• Shared inbox hygiene: Document legitimate rules and owners. Review after staffing changes.
• Vendor targeting: Accounts payable and HR inboxes are prime targets for invoice and payroll fraud. Lock down rules and verify change requests out-of-band.

Recovery After You Remove Malicious Rules

1. Rotate critical credentials: Change passwords on your primary email and any accounts where resets may have been intercepted.
2. Search for fallout: Look for forwarded messages referencing password resets, MFA changes, or new device confirmations.
3. Rebuild trust signals: Re-enable security notifications, confirm recovery channels, and review sign-in history.
4. Notify institutions: If financial or workplace accounts may be affected, alert support teams and request extra verification on profile changes or wire transfers.
5. Monitor identity and credit: Unexpected credit applications or address changes can follow email compromise. Consider enrolling in a monitoring service to catch new activity quickly. A practical option is SmartCredit for privacy, credit monitoring, and identity protection to keep watch on new credit pulls, account openings, and related alerts while you secure your accounts.

Safer Rule-Building: Do’s and Don’ts

• Do keep rules narrow, transparent, and necessary.
• Do periodically export and review your rule list, noting intended purpose.
• Do maintain a special label/folder for “Security & Account Alerts” that bypasses auto-archive and forwarding.
• Don’t create rules that touch messages containing “code,” “verification,” or “reset.”
• Don’t forward all email externally unless required by policy—and then log it and review it.
• Don’t keep legacy rules you don’t remember creating; remove or disable and observe.

How Often to Audit Your Mailbox Rules

• After any security scare: Phishing click, credential reuse, or device theft.
• Quarterly for individuals; monthly for finance/HR inboxes.
• After major account changes: New phone, recovery email, or switching email clients.
• Following provider notices: If your provider flags forwarding or unfamiliar sign-ins, check rules immediately.

Frequently Asked Questions

Will changing my password remove malicious rules?

No. Rules typically persist. You must review and delete them manually, and also remove unknown forwarding addresses and app passwords.

Are server-side rules different from client rules?

Yes. Server-side rules run even when your mail app is closed, making them more dangerous. Always check rules in the web interface or admin console.

What about IMAP and third-party apps?

Unknown IMAP sessions and connected apps can create or manipulate rules. Revoke suspicious access and disable IMAP/POP if you don’t need them.

How can I tell if a rule is legitimate?

Ask: Does it have a clear purpose you remember? Is it narrowly scoped? Does it affect security-related messages? If you’re unsure, disable it temporarily and monitor.

A 15-Minute Audit You Can Do Now

1. Sign in on the web to your email account.
2. Open Settings and navigate to Rules/Filters and Forwarding.
3. Screenshot or export your current rules.
4. Delete anything unknown, overly broad, or touching security/financial keywords.
5. Disable global forwarding unless essential.
6. Review recovery phone/email, remove anything unrecognized.
7. Turn on an authenticator or passkeys.
8. Search in:anywhere for “reset,” “verification,” and “code” to confirm messages are visible.
9. Set calendar reminders to repeat this check every quarter.

Conclusion

Fraudulent forwarding and auto-delete traps are quiet but powerful tools for account takeover. With a focused audit, tight recovery settings, phishing-resistant MFA, and regular monitoring, you can shut down that backdoor and keep critical alerts in sight. Make rules work for you: keep them simple, documented, and never applied to security messages. A few minutes of upkeep each quarter can prevent weeks of cleanup after a hidden inbox rule derails your accounts.