ojava
Start free trial

All guides

Mail forwarded outside the company

What happened

A rule or setting now sends this person's mail to an outside address. Attackers do this to read invoices and payment emails and to reply as the person.

How serious

Serious: deal with it today.

Steps: Microsoft 365

  1. Check automatic forwarding: Exchange admin center → Mailboxes → the person → Others → Manage mail forwarding. Turn off forwarding to any outside address.

    Open the page: admin.exchange.microsoft.com/#/mailboxes
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  2. Check their inbox rules: sign in as them (or sit with them) at outlook.office.com → Settings → Mail → Rules. Delete rules that forward, delete or move mail they didn't create.

    Open the page: outlook.office.com/mail/options/mail/rules
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  4. Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.microsoft.com/#/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  5. Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.

    Open the page: entra.microsoft.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Steps: Google Workspace

  1. Check forwarding and filters in their Gmail: Settings → See all settings → Forwarding and POP/IMAP, and Filters and blocked addresses. Delete what they didn't set up.

    Open the page: mail.google.com/mail/u/0/#settings/fwdandpop
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  2. Block forwarding outside the company for everyone: Google Admin console → Apps → Google Workspace → Gmail → End user access → Automatic forwarding → off.

    Open the page: admin.google.com/ac/apps/gmail/enduseraccess
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  4. Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  5. Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

How to check it’s fixed

Fixed when the person confirms the activity, or when the password is new, all sessions are signed out and no unknown method, rule or app is left. Ojava raises no new alert for them.

When to call your IT provider

Call your IT provider now if the person didn't do this, or if you are unsure.