Mailbox Security

Your Mailbox Has a Rule That Forwards Email.

Email Fraud Alert noticed that this mailbox has an inbox rule which forwards incoming messages to another address. The rule may also delete, redirect, move, or mark messages as read.

Plenty of people set these up on purpose. This page is here to help you take a look.

This is a notice, not an alarm.

This May Be Completely Normal.

Inbox rules are an ordinary Outlook feature, and forwarding is one of the most common things people use them for. You may well have set this up yourself, or someone may have set it up for you at some point.

Rules like this are often created for perfectly good reasons:

  • Forwarding your mail to another address you own, so everything lands in one place
  • Sending copies to an assistant, a colleague, or a shared team mailbox
  • Keeping a personal archive of work mail, or work mail at home
  • Filing newsletters, receipts, or notifications into folders automatically
  • A rule set up long ago that has simply been running quietly ever since

If you recognize the rule and it is doing what you intended, there is nothing here you need to change.

Why It's Still Worth a Look.

Forwarding and concealment rules are also one of the quieter tools used by people who gain access to someone else's account. A rule can send copies of incoming mail somewhere else, or move and delete messages so they are never seen — all without changing anything you would normally notice.

Because the rule runs in the background, it is easy for one to sit in place for a long time unnoticed. That is the only reason we surface it.

We're asking you to review a setting — not telling you something is wrong.

How to Check Your Outlook Rules

Outlook comes in a few different versions, and the menus differ. Find the one that matches what you use.

New Outlook & Outlook on the web

If you use Outlook in a browser, or the newer Outlook app

This is the version with the Settings gear in the top-right corner.

Settings (gear icon) → Mail → Rules

Your rules are listed there. Select any rule to see exactly what it does.

Classic Outlook for Windows

If you use the desktop Outlook app with a File menu

This is the version with the ribbon across the top and a File tab on the left.

File → Manage Rules & Alerts

Your rules are listed there. Select a rule to see its conditions and actions.

What to Look For

Read through the rules and check whether each one is something you recognize. These are the behaviors worth paying attention to — keeping in mind that any of them can be entirely intentional.

Forwards or redirects mail

Sends incoming messages on to another email address. Check whether you recognize that address.

Deletes incoming mail

Removes messages as they arrive. Common for newsletters — worth a look if it covers ordinary mail.

Moves mail to an unusual folder

Sends messages to Deleted Items, Junk, RSS, or another folder you rarely open.

Marks messages as read

Marks mail as already read before you see it, so it doesn't stand out in your inbox.

Pay particular attention to any rule you don't remember creating, especially one that combines forwarding with deleting, moving, or marking mail as read.

If You Find a Rule You Don't Recognize

Take it one step at a time. None of this needs to be rushed.

Three things to do

1
Turn off or delete the rule in Outlook. — use the same Rules screen you just opened.
2
Change your Microsoft account password. — choose a password you don't use anywhere else.
3
Review your recent sign-in and security activity. — in your Microsoft account security settings, look for sign-ins you don't recognize.

If your mailbox is managed by an employer or an IT provider, tell them what you found before making changes. They may want to look at it first.

What EFA Can and Cannot Do

Email Fraud Alert reads your mailbox rule settings so it can tell you a rule exists. That is the whole of it. EFA cannot:

  • Create, edit, turn off, or delete a mailbox rule
  • Change any other setting in your mailbox or your account
  • Decide that a rule is harmful, or that anyone else created it
  • Read, alter, or remove the messages a rule applies to

Any change has to be made by you, in Outlook.

EFA points at the setting. The decision is yours.

One Important Limitation

Not seeing this notice does not mean your mailbox is clear. EFA checks your rule settings when it runs, and it can only report what it is able to read at that moment. It does not watch your mailbox continuously, and it does not identify every possible way mail can be hidden or redirected.

Treat this page as one useful prompt to review a setting — not as a complete security review of your account, and not as an all-clear.

Most of the Time, This Is Nothing.

Most forwarding rules are exactly what they look like — something set up on purpose and long forgotten.

Taking a minute to confirm that is a good habit, and it's the whole reason we mention it.

Thank you for trusting Email Fraud Alert.