How to Tell If Your Business Email Has Been Hacked (7 Warning Signs)

Your business email may be hacked if contacts receive messages you did not send, your password or recovery details change, or unfamiliar logins and forwarding rules appear. Check your sent items, inbox rules, forwarding settings, and sign-in history. If anything looks wrong, change your password from a clean device, sign out all sessions, remove rogue rules, and call a specialist.

Introduction

A hacked business email account rarely announces itself. There is no pop-up and no warning banner. In many cases the attacker sits quietly in the mailbox for days, reading your conversations and waiting for the right moment to act.

That is why knowing how to tell if your business email has been hacked matters so much. The earlier you spot the signs, the less damage a criminal can do to your clients, your suppliers, and your bank balance.

This guide covers seven clear warning signs, the hidden settings attackers use to stay in your mailbox, and how to check Microsoft 365 and Google Workspace step by step. It also explains what to do in the first hour and how to stop it happening again. It is written for UAE business owners and office managers, so no technical background is needed.

What Are the Signs That Your Business Email Has Been Hacked?

Your business email has likely been hacked if people receive messages you did not send, your password or recovery details have changed, or your account shows logins from unknown devices or places. One sign alone is not proof, but two or more together mean you should act now.

Here are the seven warning signs to look for:

1. Contacts tell you about strange emails from you. Clients, suppliers, or colleagues say they received a odd message, link, or invoice from your address. This is one of the most reliable signs.
2. Your Sent folder shows messages you did not write. Attackers sometimes delete these, so also ask your contacts and check the Deleted Items folder.
3. Your password or recovery details changed. If you are suddenly locked out, or your recovery phone number or backup email is different, someone else may have made the change.
4. Unfamiliar logins, devices, or locations appear. A login at 3 a.m. from a country you have never visited is a red flag. Remember that a VPN or travel can also cause odd locations, so check against what you know.
5. Replies and expected emails go missing. If a client says they replied but you never saw it, a hidden rule may be moving or deleting your mail.
6. You get security alerts you did not trigger. Notices about new sign-ins, blocked sign-ins, or changed settings deserve attention. Open your account directly rather than clicking the link in the alert.
7. Password reset emails arrive for accounts you did not touch. An attacker inside your mailbox may be trying to take over your other services, such as banking portals or cloud tools.

If you spot any of these, move on to the checks below.

Why Are Hidden Forwarding Rules and Inbox Filters the Biggest Red Flag?

Hidden forwarding rules are the biggest red flag because they let an attacker keep reading your email even after you change your password. A rule can quietly copy every incoming message to an outside address, or delete replies so you never notice the fraud.

Think of it like a stranger who copies your office key. Changing the locks later does not help if the copy is still in their pocket. A forwarding rule works the same way. The attacker sets it once, and it keeps working in the background.

Attackers commonly create rules that do one or more of these things:

• Forward all incoming mail to an outside address
• Forward only messages that contain words like “invoice,” “payment,” or “bank”
• Move replies from clients or finance contacts into a rarely checked folder
• Delete messages that could reveal the attack, such as security alerts or bounce notices

Rules can also hide in places people rarely look. Some forwarding is set at the mailbox level in the admin settings, not in the inbox rules list. So a full check means looking in both places.

What to look for: any rule you or your IT team did not create, any rule that sends mail outside your company, and any rule with a strange or blank name.

How Do You Check Microsoft 365 and Google Workspace for Signs of a Breach?

You check for a breach by reviewing three things: where and when the account signed in, which rules and forwarding settings exist, and which devices and apps have access. Both Microsoft 365 and Google Workspace show all three. Menu names can change, so treat these steps as a guide.

Microsoft 365: sign-in logs and mailbox rules

• Check inbox rules. Sign in to Outlook on the web, open Settings (the gear icon), search for “rules,” and open Inbox rules. Look for anything you did not create.
• Check mailbox forwarding. In the Microsoft 365 admin center, go to Users, then Active users, select the person, and open the Mail tab. If email forwarding shows as applied, open Manage email forwarding and see where the mail is going.
• Check sign-in logs. An administrator can review sign-ins in the Microsoft Entra admin center. Look for logins at odd hours, from unfamiliar countries, or from devices that do not match your team.
• Check for signs on the account itself. A mailbox blocked from sending email, or a changed email signature, can also point to a compromise.

Google Workspace and Gmail: activity, devices, filters, and delegation

• Check last account activity. At the bottom of your Gmail inbox, find “Last account activity” and click Details. Review the list of devices and locations.
• Check signed-in devices. In your Google Account, open Your devices and then Manage devices. Sign out any device you do not recognise.
• Check forwarding. In Gmail settings, open the Forwarding and POP/IMAP tab and look for an address you do not know.
• Check filters. Open Filters and Blocked Addresses and look for filters that forward, delete, or hide messages.
• Check delegation. In the Accounts tab, look under the section for granting access to your account. Remove anyone who should not be there.

If you manage many mailboxes, this takes time. This is where a managed monitoring service can help, because it watches sign-ins and rule changes for you around the clock.

What Does a Hacked Business Mailbox Look Like in a Payment Fraud Attempt?

In a payment fraud attempt, a hacked mailbox is used to send a believable message from a real address, such as a supplier asking you to change bank details. Because the email comes from a genuine account and sits inside a real conversation, it is very easy to trust.

Here is how it often works. The attacker reads your email for days or weeks. They learn who pays whom, when invoices are due, and how your team writes to each other. Then they step in with a message that fits the pattern perfectly.

Common patterns include:

• A supplier “updates” their bank account just before a payment is due
• A manager asks finance to make an urgent, confidential transfer
• A reply to a real invoice thread with new payment instructions
• A request to keep the matter quiet or avoid phoning to confirm

This differs from email spoofing, where a criminal fakes the sender name or domain without entering any mailbox. Our guide on how email spoofing differs explains the technical side. The difference matters because a spoofed email can often be traced by its headers, while a message from a hacked mailbox comes from the genuine account.

The rule that protects you: never act on a bank detail change by email alone. Call the person on a number you already have on file, and ask for a second approver on every new payee.

What Should You Do in the First Hour If Your Email Is Hacked?

In the first hour, secure the account, remove the attacker’s access, and warn the people at risk. Act quickly and in order. Speed matters more than perfection at this stage.

1. Use a clean device. If your computer may be infected, a new password could be stolen again. Use a different, trusted device to make changes.
2. Change the password. Choose a long, unique password that you do not use anywhere else. Do not send it by email or chat.
3. Sign out all sessions. Force a sign-out on every device so the attacker loses access. In Microsoft 365 this is done by an administrator, and Google lets you sign out unknown devices.
4. Remove rogue rules and forwarding. Delete any rule, filter, or forwarding address you did not create. Also check delegated access.
5. Check recovery details. Make sure the recovery phone number and backup email are yours.
6. Turn on or tighten multi-factor authentication. If you have not enabled it yet, our guide to multi-factor authentication explains why a password alone is not enough.
7. Warn staff, clients, and suppliers. Tell them to ignore recent unusual messages, especially anything about payments. Ask your bank to stop any suspicious transfer.
8. Call a specialist. An expert can check logs, find how the attacker got in, and confirm whether other accounts are affected.

Changing a password alone does not remove an attacker who has set a forwarding rule or has an active session. That is why steps 3 and 4 matter.

How Can You Stop It Happening Again?

You can reduce the risk by combining strong sign-in, a dedicated email security layer, active monitoring, and regular staff training. No single tool is enough on its own, but together they make your business a much harder target.

• Strong sign-in. Use multi-factor authentication on every mailbox. Give the strongest protection to admins, finance staff, and shared mailboxes such as accounts@ and info@.
• A dedicated email security layer. Built-in filters block a lot, but a specialist layer adds checks for phishing, impersonation, and malicious attachments. Our advanced email security solutions are built for this.
• Round-the-clock monitoring. Many attacks start outside office hours. Our 24/7 SOC monitoring watches for unusual logins and rule changes so a small incident does not grow.
• Fix the basics. Many businesses leave gaps they do not know about. Our post on the common email security mistakes shows the five we see most often.
• Short, frequent training. Staff who know the warning signs report problems sooner. Our cybersecurity plans for small businesses include email protection, monitoring, and user awareness training.

Conclusion

A hacked business email account is easy to miss but costly to ignore. Watch for strange messages from your address, changed settings, unknown logins, missing replies, and above all hidden forwarding rules. When you find a warning sign, act in the first hour: secure the account, remove the attacker’s access, and warn the people at risk.

If you are not sure whether your mailbox is safe, we can help. As a trusted cybersecurity company in Dubai, we review your email setup, check for signs of compromise, and put protection in place. Book a free consultation, or call or WhatsApp us on +971 52 607 3989.

FAQ