Signs your work email account has been hacked

Why takeovers often go unnoticed

People imagine a hacked account as something dramatic: a locked inbox, a ransom note, everything deleted. In reality, attackers who get into a business mailbox usually want to stay hidden for as long as possible. They read quietly, learn who pays whom, and wait for the right moment to send a fake invoice or bank change request. The longer they go unnoticed, the more they learn and the more convincing their fraud becomes. That means the signs are usually small and easy to dismiss as glitches. Knowing what they look like lets staff raise them early, when fixing the problem is quick.

Messages you didn't send

Check your sent items and deleted items now and then. Emails you don't remember writing, especially ones sharing a document, asking for payment or sent to many contacts at once, are a strong sign someone else has access. Attackers often delete their sent messages afterwards, so look in deleted items too. Another sign comes from outside: a supplier asks why you sent them a link to a shared file, a customer phones to check a bank account change, or several people reply 'did you mean to send this?' Take these seriously, even if your own mailbox looks normal.

Missing replies and strange inbox rules

If you're expecting a reply that never arrives, or a whole conversation seems to have gone quiet, look at your inbox rules. Attackers create rules that move emails containing words like invoice, payment, bank or your name into obscure folders such as RSS Feeds or Archive, or mark them as read and delete them, so you never see the replies to their fraudulent messages. Also check forwarding settings. An automatic forward to an outside address sends copies of everything you receive to the attacker, even after they lose direct access. In Outlook and Gmail, rules and forwarding are in the settings; if you're unsure what you're looking at, ask IT to check.

Unusual sign-in alerts and activity

Microsoft and Google may email or notify you about sign-ins from new devices or locations. Don't ignore them. Your account security page shows recent sign-in activity, and seeing a sign-in from a country you haven't visited, or at an hour when you were asleep, is a clear signal. Unexpected multi-factor prompts, password reset emails you didn't request, or a sudden need to re-enter your password on all your devices can also indicate trouble. So can new apps connected to your account that you don't recognise, which attackers sometimes add to keep access.

Signs IT may spot before you do

Administrators can see patterns individuals can't: sign-ins from overseas cloud servers, a burst of failed attempts followed by success, large numbers of files downloaded from OneDrive or SharePoint, or many emails sent in a short time. Microsoft 365 and Google Workspace include alerts for some of these, depending on your licence. If nobody is watching those alerts, they're not much use. Ask whoever manages your IT who receives security alerts and how quickly they're reviewed. In a small business it's common for alerts to go to an old admin address nobody checks.

What to do if you see the signs

Don't wait to be sure. Tell IT immediately and, from a different trusted device, change the account's password. IT should sign the account out of all sessions, review and remove unfamiliar MFA methods, inbox rules, forwarding and connected apps, and check sign-in logs to see when the attacker first got in.

Then deal with the people who may have been affected. Warn contacts who received suspicious messages from you, and confirm with any supplier or customer whether a payment or bank change has been requested. If personal information may have been accessed, the business should assess whether the breach is notifiable under the Privacy Act 2020.

Preventing the next one

Most mailbox takeovers start with a stolen password and no strong multi-factor sign-in. Turn on MFA for every account, preferably with number matching or a phishing-resistant method, and block older sign-in protocols that bypass it. Use a password manager so passwords aren't reused. Set up alerting for new forwarding rules and unusual sign-ins, and make sure someone reads the alerts. A periodic review of rules and forwarding across all mailboxes is a cheap check that catches hidden problems. If you'd like a fresh pair of eyes on your settings, an IT health check from Office IT includes a review of Microsoft 365 security.