Most people expect a hacked email account to be visually obvious, with a password that stops working or a screen full of warnings. In practice, the attacker wants the opposite. They want to stay in your mailbox for as long as possible, reading your conversations and waiting for a payment worth redirecting. The warning signs are small, and they’re easy to explain away.
In our latest cyber security series, we’ve been looking into some of the most common threats businesses are facing right now. In this blog we explain how you can tell if your email has been hacked, the five-minute checks you can do yourself in Outlook, and what to do if something doesn’t look right. It’s written for anyone using Microsoft 365 at work, though most of it applies to any email account.
Why a hacked email account is hard to spot
Once cybercriminals have your password, your mailbox is far more useful to them open than locked. They can read months of genuine emails, learn who pays who and when, along with important trust details like how you sign off. When an invoice thread looks promising, they reply to it from your real email address with new bank details. That’s business email compromise, which we explained in phishing vs spear phishing vs whaling.
None of that needs you to notice anything. Your email still works, your password still works and your messages still arrive (mostly). The smaller signs are often the only ones you’ll get.
What are the signs your email has been compromised?
These are the signs Microsoft and the NCSC both point to, along with what our engineers find when they investigate:
- People reply to emails you didn’t send. A colleague asks why you sent them a link, or your contact list starts getting spam or phishing emails sent from your account.
- Replies you’re expecting never arrive. A supplier says they answered yesterday, but there’s nothing there. This is often down to a hidden rule (more on that below).
- Emails turn up in folders you never use. Microsoft specifically lists rules that move messages into the RSS Subscriptions, Notes or Junk Email folders, because people rarely look there.
- Your sent emails or Deleted Items look wrong. You might find messages you don’t recognise, or a Deleted Items folder that’s been emptied when you didn’t empty it.
- You get sign-in codes or approval alerts you didn’t ask for. If your phone asks you to approve a login you didn’t start, someone else has probably typed in your password.
- You’re locked out of your account. This is the obvious sign, and usually the last to happen.
- Your settings have changed. You might spot a new signature, a forwarding address you didn’t add, or a different recovery email or phone number.
One sign on its own isn’t proof. A missing reply might just be a missing reply. Two or three together are worth a call to your IT team the same day.
The hidden inbox rule most people miss
When we investigate a confirmed account takeover, one of the first things we often find is an inbox rule the user never created. The rules are simple. One might delete every email from a particular supplier. Another might move anything mentioning an invoice or payment into a folder nobody opens.
Picture how that plays out. The attacker emails a client or supplier from your account with new bank details. They sensibly email back to check it’s genuine. The rule moves that reply out of your sight, and the attacker answers it: “Yes, that’s right, please use the new account.” We’ve seen a version of this: a supplier emailed to check whether a message was genuine, and the attacker replied to say it was. The person on the other end did the right thing by checking, but they checked by email, and email was the part that had been compromised. That’s why anything involving bank details should be confirmed by phone, on a number you already hold.
Some rules can also be hidden from Outlook altogether. You can check the rules you can see (below), and your IT team can check from the admin side, where hidden rules show up too.
How to check if your email has been hacked in five minutes
These checks take a few minutes and don’t need any technical knowledge. Find your version of Outlook along the top and follow the steps down that column.
Not sure which one you have? If there’s a File tab in the top left, it’s classic Outlook. If there’s a “New Outlook” switch in the top right that’s turned on, it’s the new Outlook. If you’re in a web browser, it’s Outlook on the web.
Swipe the table sideways to see classic Outlook.
| Check | New Outlook | Outlook on the web | Classic Outlook |
|---|---|---|---|
| 1. Inbox rules Look for anything you didn’t create, especially rules that delete, forward or move messages. | Settings, then Mail, then Rules | Settings, then Mail, then Rules | File, then Manage Rules & Alerts |
| 2. Forwarding Unless you set it up yourself, it should be switched off. | Settings, then Mail, then Forwarding | Settings, then Mail, then Forwarding | There’s no forwarding setting here. Check in Outlook on the web instead. |
| 3. Account activity Locations are approximate, so a nearby town isn’t a worry. A login from another country while you were at your desk is. | The same for every version. In a browser, go to mysignins.microsoft.com and open Recent activity to see when and roughly where you’ve signed in. | ||
| 4. Security info Every phone number and authenticator app listed should be yours. Attackers sometimes add their own so they keep access even after you’ve changed your password. | The same for every version. On the same site, open Security info. | ||
| 5. Rarely checked folders Look for replies you never saw arrive. | The same for every version. In your folder list, open RSS Subscriptions, Notes, Archive and Junk Email. | ||
If something turns up, don’t delete it yet. Tell your IT team first, because the rule or the login record shows them what the attacker could see, and for how long.
It’s also worth checking whether your email address has been exposed in a data breach. A free email breach checker such as Have I Been Pwned will tell you. Appearing there doesn’t mean your account has been hacked. It means a password you used on another website may be circulating on the dark web, so if you’ve reused it anywhere, change it.
The password worked, but the location didn’t
More than 80 times so far this year, across the businesses we support, we’ve seen someone sign in to a Microsoft 365 account with the correct password from another country. The only thing that stopped them was a Conditional Access policy saying, in effect, “this account doesn’t sign in from there”.
Each of those is a stolen credential that already works. Without the location rule, every one would have been an account takeover, and in most cases the person whose password it was would never have known. The password was most likely caught by a fake sign-in page or reused from a breached website. You often wouldn’t know your password had been stolen, which is why your protection shouldn’t rely on the password alone.
When it’s your supplier’s email that’s been hacked
Your own mailbox isn’t the only one that matters. We regularly see phishing that arrives from a real supplier’s real address, because their account has been taken over. It’s usually a shared “invoice” or “proposal” document sent to everyone they deal with, which opens a fake Microsoft sign-in page or carries malware.
These emails pass every “do I know this sender?” check, because you do. The clues are in the request: a document you weren’t expecting, a sign-in page before you can open it, or a tone that isn’t quite theirs. If in doubt, ring them.
What to do if your email has been hacked
Speed matters more than getting every step perfect:
- Tell your IT team straight away, by phone rather than email. They can sign the attacker out of every session, which changing the password doesn’t always do on its own, and remove rules, forwarding and any sign-in methods the attacker added.
- Change your email password, and use a unique password for every account. A password manager makes that realistic. Don’t send a new password to anyone by email, because the attacker may still be reading it.
- Warn the people who might be targeted next. Clients and suppliers who pay you, or who you pay, should hear from you by phone that any recent bank detail change from your address needs checking.
- If money has been paid, contact your bank immediately and report it to Report Fraud (formerly Action Fraud). The NCSC’s guide to recovering a hacked account covers the rest.
If you don’t have IT support and need help now, our emergency cyber security page sets out what to do in the first hour.
How to protect your email from hackers
- Turn on multi-factor authentication for every account, including shared mailboxes and the managing director’s. Phishing-resistant options such as passkeys go further, because they won’t work on a fake sign-in page.
- Use location and device rules. Conditional Access is included in Microsoft 365 Business Premium. After an incident, we sometimes find a business was already paying for stronger protection, but it had never been switched on.
- Block automatic forwarding outside your business, so a hidden rule can’t secretly copy your email elsewhere.
- Keep offboarding tidy. A leaver’s mailbox that still exists, or is still being forwarded, is one more account to watch. Our IT offboarding checklist covers what to close down.
How we help
At Ingenio, we look after businesses across Brighton, Sussex and the South East. A hacked Microsoft 365 account is one of the incidents we take most seriously, because of what an attacker can do while they’re in.
Our Microsoft 365 identity protection service, powered by Huntress, watches for the signs in this post, such as new inbox rules, unusual forwarding and sign-ins from places your team doesn’t work. When it spots one, we can sign the attacker out and lock the account down quickly. Our security awareness training helps your team spot the phishing that steals passwords in the first place.
Frequently asked questions
Can someone be in my email without me knowing?
Yes, and that’s usually the aim. Someone with your password can read and send email alongside you without changing anything you’d notice. Inbox rules, forwarding and your recent sign-in activity are what give them away.
Will changing my password stop a hacker?
Not always on its own. An attacker may stay signed in on an existing session, keep a sign-in method they added, or keep receiving your email through a forwarding rule. Your IT team should also sign out every session and check rules, forwarding and security info.
How can I tell if my email has been hacked or spoofed?
Spoofing means someone has faked your address without getting into your account, so your sign-in activity will look normal and there are no new rules. If you find logins you don’t recognise or rules you didn’t create, the account itself has been hacked. Our guide to email spoofing explains the difference.
Why am I getting Microsoft verification codes I didn’t ask for?
Usually because someone has your password and is trying to sign in. Don’t approve the request or share the code. Change your password and tell your IT team, so they can check whether anyone got further.
Does being in a data breach mean my email has been hacked?
No. It means details from a website you used have leaked, which may include a password. If you’ve used that password for your email or any of your other online accounts, change it and make sure two-factor authentication is switched on.
Final thought
A hacked email account rarely looks like one. It looks like a missing reply or a sign-in code you didn’t ask for. Five minutes in your settings will tell you more than any warning screen, and if something doesn’t look right, it’s always worth a call.
👉 Talk to us about protecting your Microsoft 365 accounts. We’re happy to talk it through.
