How to Check for Forwarding Rules Set by Hackers

If you suspect someone else has been reading your email, the first thing to check is your account's forwarding rules and filters. Cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, and that copy lets them reset your passwords on other services¹. The National Cyber Security Centre (NCSC) lists checking for unwanted forwarding rules as a standard step in recovering a hacked account².

The fix is a short sequence, and the order matters. Find the rule, remove it, then change your email password on a device you trust, and change it anywhere else you used the same one³. After that, turn on 2-step verification and tell the people in your address book to be wary of messages that appear to come from you².

This page covers where the rules hide in a typical email account, what an unwanted one looks like, how to remove it safely, and the other steps that close the door behind you. It applies to personal accounts on any provider. If the account belongs to your employer, the advice is different: tell your IT department rather than changing settings yourself⁴.

Why criminals set up forwarding rules

A forwarding rule is a setting that tells your email account to send a copy of incoming messages somewhere else. Most people never create one, and that is exactly why it suits a criminal. It runs silently in the background, it survives you changing your password in some cases, and it gives the attacker a live feed of everything that arrives: bank statements, password reset links, order confirmations, messages from family.

The reason it is so valuable is what email controls. If a criminal can access your email account, they could access private information about you, including your banking details, post emails and messages pretending to be from you, and reset all your other account passwords⁵. Your email address is normally your username on many other services, so the inbox is the master key to much of your online life⁸.

There is a second reason the rule is popular: it hides the evidence. If password reset messages are being copied to the criminal, you may never see the warning signs in your own inbox. That is why the NCSC treats checking forwarding rules as a routine part of recovery rather than an unusual step².

Where to find forwarding rules and filters in your email account

Every provider lays its settings out differently, but the categories are consistent. Sign in to your email on the web rather than relying on an app, because app menus often hide the full settings. Then look for a section labelled Settings, then something like Forwarding, Filters, Rules or Inbox rules. The NCSC's general starting point is to go to the account provider's website and search its help or support pages for the account recovery process³.

Work through these places:

• Forwarding: any entry that sends mail to an address you do not recognise, or that keeps a copy on a server you do not use.
• Filters and rules: conditions that move, label, archive, mark as read or delete messages. A rule that quietly bins anything containing the word "password" or "security" is a red flag.
• Connected apps and delegated access: third-party apps granted permission to read your mail.
• Recovery and contact details: a changed recovery address or phone number is a sign someone else has been in.

If you cannot get into the account at all, or you see activity you do not recognise such as changes to security settings or password reset messages, treat it as a possible hack and follow the provider's recovery process⁹. The NCSC advises reading its guidance on recovering a hacked account in advance, so you know what to do if it happens⁹.

What an unwanted forwarding rule looks like

You are looking for anything you did not set up yourself. The clearest sign is a destination address you do not recognise, particularly one made of random letters or numbers, or a free webmail address that is not yours. A rule that forwards everything, rather than selected messages, is more suspicious than a narrow one.

Filters can be just as damaging as forwarding. A filter that deletes or hides messages can bury the alerts that would tell you something is wrong, including password reset emails and security notices. Check every rule, not just the ones at the top of the list, and read the conditions as well as the action.

Other signs that an account has been tampered with include messages bouncing back, contacts receiving emails you did not send, and unexpected password reset messages arriving. The NCSC notes that unexpected emails sent from your account advertising unlikely products or asking for money are a sign of infection¹⁰. If a friend tells you they have had a strange message from you, take it seriously.

Remove the rule, then change your password on a safe device

Once you have found an unwanted rule, delete it and save the change. Then, and only then, change your password. The NCSC's recovery steps put it plainly: change the password for any account that has been hacked, and also for any accounts that use the same password². Doing it in this order means the criminal's copy of your mail stops before you lock them out, so they cannot intercept the reset confirmation.

Change the password from a device you trust, ideally one you have not used to open any suspicious links. If you have re-used your email password across other accounts, change your email password as soon as possible, and make it strong and different to all your other accounts⁵. A password manager can generate and store strong, separate passwords so you do not have to remember them all¹².

Other steps to recover a hacked email account

Removing the rule and changing the password deals with the immediate problem. The remaining steps stop it happening again and limit the damage already done.

1. Turn on 2-step verification (2SV). The NCSC describes this as the first and most important step to help protect you if your password gets phished or otherwise compromised¹². It usually works by sending a PIN or code, often by text message or email, to prove it is really you². The option is usually in the security settings of your account⁶.
2. Check your bank and shopping accounts. Keep a look-out for unauthorised purchases, or check your bank accounts for any unusual transactions³. Contact your bank directly using official websites or channels, not links in messages³.
3. Tell your contacts. Let them know you were hacked, and suggest they treat any recent messages from your account with suspicion².
4. Check whether your details appear in a breach. The NCSC points to haveibeenpwned.com to check if your account has been compromised and to get future notifications¹³.
5. Report it. Forward suspicious emails to report@phishing.gov.uk, where the NCSC will investigate⁷. Suspicious texts can be forwarded free to 7726¹⁴.

If you have lost money, contact your bank immediately through its official channels. If you believe your account has been fraudulently accessed, the NCSC directs you to its actions to take to recover a hacked account¹⁵.

If the rule comes back, or the account is not yours

A rule that reappears after deletion is a strong signal that the criminal still has a way in. That usually means a reused password on another account, a compromised recovery address, or a connected app with ongoing access. Work through the settings again, change the password on every account that shared it, and turn on 2SV. If it still returns, contact your provider's support team and follow their recovery process³.

For a work account, do not change settings yourself. The NCSC advises that if a suspicious message arrived on a work laptop or phone, you should contact your IT department and let them know⁴. They can check the account properly and reset access without breaking anything.

If you are helping someone who is blind or partially sighted, the RNIB's online safety guidance suggests looking out for spelling and punctuation mistakes, generic greetings, or incorrect information, which can all be signs of a potential phishing email¹⁶. The same checks apply when reviewing rules and filters together.

For the wider picture, see our guides to recovering a hacked email account, protecting email and bank accounts and turning on 2-step verification.