Email accounts often contain more business information than staff realise. They may hold customer enquiries, invoices, password-reset links, supplier conversations and access to cloud applications. A mailbox rule that quietly forwards messages, deletes alerts or moves security notifications can therefore create a serious business risk.
For Australian small and medium businesses, checking mailbox rules should be part of routine account maintenance. It is a practical control that can reveal suspicious forwarding, reduce the impact of a compromised account and improve visibility when staff change roles.
Why forwarding rules deserve attention
Attackers who gain access to an email account may create a rule that forwards selected messages to an external address, marks them as read or hides replies in an unfamiliar folder. Criminals may use this access to monitor invoices, impersonate staff or intercept information used in payment changes.
Not every forwarding rule is malicious. Some businesses use approved shared mailboxes, archiving services or customer-service workflows. The important point is that every rule should have a known owner and a documented business reason.
Run a simple mailbox-rule review
- List external forwarding addresses, inbox rules, transport rules and automatic replies.
- Check whether each rule is still needed, who approved it and what information it can access.
- Look for rules that delete, hide, redirect or automatically mark messages as read.
- Review sign-in history and recent security alerts for the mailbox and the user account.
- Remove unknown rules, reset the account credentials and revoke active sessions if compromise is suspected.
Reduce the chance of silent changes
Use multi-factor authentication for email and administrator accounts, with phishing-resistant options where the platform supports them. Limit administrator permissions, keep separate admin accounts and make mailbox changes part of a change-control process. Alerts for new forwarding rules or unusual sign-ins should go to a monitored security or IT mailbox rather than only to the account being changed.
Protect payment and customer workflows
Do not rely on email alone to approve a change to bank details, supplier payment instructions or a new destination for customer data. Confirm important changes through a known phone number or another trusted channel. This simple step protects the business even when an email account has been accessed.
A monthly checklist
- Review external forwarding and high-impact inbox rules.
- Check recent sign-ins and authentication alerts.
- Confirm departed staff and old shared accounts are disabled.
- Test that suspicious messages and security alerts reach the right person.
- Record exceptions, owners and the next review date.
How Xpansion Technologies can help
Xpansion Technologies helps Australian businesses improve practical email security, identity controls, cloud systems, websites, software, cybersecurity and automation. A clear mailbox-rule review is a small operational habit that can prevent a quiet email compromise from becoming a larger business problem.
Sources
Leave a comment