Seven signs your business email has been compromised

The warning signs

• Inbox rules you did not create, especially ones that move messages to Archive, RSS Feeds, or Deleted Items.
• Contacts saying they received an email from you that you never sent.
• Sent items that disappear, or replies to conversations you do not recognise.
• Sign-in alerts from unfamiliar locations or devices.
• A sudden wave of password reset emails for other services.
• Your messages landing in spam for people who always received them fine.
• A vendor or client asking you to confirm changed bank details.

Hidden inbox rules are the classic tell. They exist so you never see the replies the attacker is handling on your behalf.

What to do in the first hour

1. Change the password from a different, known-clean device.
2. Sign out all active sessions so existing tokens stop working.
3. Turn on multi-factor authentication if it is not already enforced.
4. Review and delete unfamiliar inbox rules and forwarding addresses.
5. Check which apps have been granted access to the mailbox and revoke anything unexpected.
6. Review sign-in logs to see how far back the access goes.
7. Warn staff and any client who may have been sent a fraudulent message.

Do not skip the money conversation

If invoices or payment details passed through the mailbox during the compromise, verify them by phone using a number you already had — never one from the email. This is where the actual loss usually happens.

Preventing the next one

MFA on every account, blocked legacy sign-in methods, alerting on new inbox rules, and a short staff briefing on invoice fraud will stop the overwhelming majority of these incidents before they start.