The Forwarding Address You Never Added: A Five-Minute Email Audit Before the Christmas Break

You know the feeling. A client swears they replied to your quote last week. You search your inbox and find nothing. Or a supplier says they emailed a revised bank detail form, but your inbox is silent. Sometimes the explanation is a spam filter having a bad day. Sometimes it is a rule sitting quietly in your mailbox that you never wrote.

That is the sort of thing worth checking before the Christmas break, when small firms are juggling final invoices, festive cover and an inbox that nobody is watching quite as closely as usual.

The rule that is not yours

When a scammer gets into a business email account, they do not always need to stay logged in. One of the most useful things they can leave behind is a mail rule. In Outlook and Microsoft 365 it might be called an inbox rule. In Gmail it is a filter. Either way, it can do something simple and damaging: forward every message that mentions 'invoice' to an address you do not recognise, move password reset emails out of sight, or delete replies from a particular customer before you ever see them.

You may never get a dramatic warning. The account can look normal. The scammer can log out and let the rule do the work.

Why a quiet filter is so useful to a fraudster

Think about what passes through a small firm's inbox in a normal week. Quotes, purchase orders, delivery notes, remittance advice, password resets, bank detail changes, HMRC nudges, VAT reminders. A hidden rule can cherry-pick the useful bits and send them elsewhere, while the owner sees only the everyday chatter.

The classic pattern is an invoice scam. A scammer monitors a thread, waits for a real invoice to go out, then sends a follow-up from a lookalike address asking for payment to a new account. If a rule is hiding the customer's reply, or hiding the warning from your bookkeeper, the fraud has more time to work. Password reset emails are just as valuable. If a scammer can see a reset link for your accounting software, email or banking portal, they can try to move further in.

The reason these rules are easy to miss is simple: most people never look at them. We check inboxes, not settings.

A five-minute check for Outlook and Microsoft 365

If you use Outlook on the web or Microsoft 365, start there. Sign in, open Settings, then look for Mail and Rules. Check every rule, not just the ones you remember making. Look for anything that forwards mail, redirects mail, moves messages to a folder you do not use, marks messages as read, or deletes them. Also check the forwarding settings for the mailbox itself. A rule called something bland like '.' or 'admin' is worth a second look.

If you have a Microsoft 365 admin account, ask whoever manages IT to check the Exchange admin centre for mail flow rules too. These sit at organisation level and can be missed if you only look inside one mailbox.

The Gmail version

In Gmail, open Settings, then see all settings. Check Forwarding and POP/IMAP for a forwarding address you did not add. Then check Filters and Blocked Addresses. Look for filters that forward, delete, mark as read, or apply a label that hides messages from the inbox. Scammers often use a filter that sends replies from a specific client to the archive, so the conversation looks one-sided.

While you are there, check the account recovery options and recent security activity. If you see a device or location you do not recognise, sign out of all sessions.

If you find a rule you did not create

Do not just delete it and carry on. Take a screenshot first. Note the forwarding address or the exact filter details. Then remove the rule, change the password, sign out of all active sessions and turn on multi-factor authentication if it is not already on.

Next, check Sent Items and Deleted Items for messages you did not send. If invoices or bank details were involved, contact your bank and the affected customers quickly. In the UK, report the incident to Action Fraud and consider the NCSC's guidance for small businesses. If client money is at risk, a phone call beats an email every time.

Make it a pre-Christmas habit

The festive break is a good deadline because it is also a risk window. Offices go quiet, cover staff may not know the usual invoice process, and a rule that forwards a few messages can sit unnoticed for days. A short check now is less painful than a January spent untangling payments.

Put a ten-minute reminder in the diary for the last working week. Check mailbox rules and forwarding for every shared inbox, not just the boss's account. Ask staff to report any unexpected password reset emails. And if you use an IT provider, ask them to confirm that organisation-level mail rules have been reviewed.

It is not the most glamorous security job. But an inbox rule you did not write is one of the quietest ways for a scammer to keep a hand in your business long after the password has been changed. Five minutes now is a reasonable trade.