Signs your business email account has been compromised, and what to do

A compromised mailbox is more dangerous than a stolen password. The attacker reads your conversations, sends mail that passes every authentication check, and can quietly redirect payments for weeks. This guide lists the signs to watch for and the response steps from Microsoft, Google and the UK NCSC.

What are the signs a business email account is compromised?

Microsoft's compromised account guide and Google's hacked account help list similar warning signs. Grouped by where you'll notice them:

Unexpected MFA prompts

A sign-in prompt you didn't start means someone has your password. Don't approve it. Attackers sometimes send repeated push requests hoping you'll tap "approve" to make them stop. CISA's phishing guidance recommends FIDO or PKI-based MFA, which is phishing resistant, and number matching where push MFA is still in use, "to mitigate MFA fatigue."

Bounces for mail you didn't send

A flood of non-delivery reports doesn't always mean you were hacked. If the bounced messages aren't in your Sent Items, someone probably forged your address and the bounces are backscatter. If they are in Sent Items, treat the account as compromised. Paste a bounce into the SMTP Error Code Lookup to see what the receiver objected to, and see 550 5.1.10 for one common example.

Blocked from sending

In Microsoft 365, an account that exceeds the service's sending limits or outbound spam policies is restricted. Microsoft says the user can still receive mail, but sent messages bounce with:

550 5.1.8 Access denied, bad outbound sender

Microsoft calls exceeding outbound limits "an indicator of a compromised account" (Microsoft Learn). Our guide to a Microsoft 365 user blocked from sending covers the unblock steps in detail. If you run your own mail server, a sudden listing on a public blocklist is the equivalent signal; check your IPs with the Blacklist Checker.

What should you do first if a mailbox is compromised?

Act in this order. The goal is to cut the attacker off before you investigate, then close every way they could get back in. Microsoft warns that its steps "address known methods that might allow the attacker to maintain persistence," so do all of them, not just the password.

1. Block access. Microsoft recommends disabling the account during the investigation. In Google Workspace, suspending the user also "resets the user's sign-in cookies and OAuth tokens" (Google Workspace Admin Help).
2. Reset the password from a clean device. Use a strong, unique password. Microsoft says not to send the new password to the user by email, "because the attacker could have access to the mailbox."
3. Revoke sessions. In Microsoft 365, revoke all sign-in sessions and refresh tokens (Revoke-MgUserSignInSession). In Google Workspace, reset the user's sign-in cookies. NCSC's advice is to make sure "any devices and apps" that may still be signed in are logged out.
4. Remove app passwords. Microsoft notes that app passwords "aren't automatically revoked when you reset the password." Google tells admins to remove any app passwords the user created.
5. Check MFA methods and devices. Remove any phone, authenticator app or security key the user doesn't recognize. Microsoft tells admins to remove any devices or methods an attacker added.
6. Review app consents. Revoke OAuth applications the user didn't knowingly approve. Google's admin steps include revoking the user's OAuth 2.0 tokens, so an app the attacker approved doesn't keep its access.
7. Review admin roles. Remove any roles that shouldn't be there, especially if the account is an admin.
8. Remove forwarding and rules. Record what each rule or forwarding setting did, then remove it. See the next section for where to look.
9. Turn on MFA, ideally phishing-resistant. CISA says "any MFA is better than no MFA," and names FIDO/WebAuthn as the only widely available phishing-resistant option (CISA).

If the user only clicked a link and you caught it early, the shorter checklist in what to do after clicking a phishing link may be enough.

Where do attackers hide in a mailbox?

Microsoft 365

• Forwarding: Get-Mailbox -Identity user@example.com | Format-List Forwarding*Address,DeliverTo*. A value in ForwardingSmtpAddress means mail goes to an external address.
• Inbox rules, including hidden ones: Get-InboxRule -Mailbox user@example.com -IncludeHidden. Look at RedirectTo, ForwardTo and ForwardAsAttachmentTo.
• Sign-in logs: Microsoft Entra sign-in logs show IP addresses, locations, times and success or failure.
• Audit log and message trace: Filter from just before the suspicious activity, and check what the account sent.

Google Workspace

• Gmail settings: Google's help lists mail delegation, automatic forwarding, filters, labels and IMAP or POP access as settings to check.
• Admin logs: User log events for sign-ins, Email log search for message activity, and OAuth log events for app grants.
• Devices: Review mobile devices tied to the account and wipe any that look suspicious.

How do you recover after securing the account?

Investigate what the attacker did

Work out the time window from the sign-in logs, then review every message sent in that window. Look especially for:

• Payment or bank-detail requests sent to customers or suppliers.
• Replies inserted into existing invoice threads.
• Mail sent to large numbers of contacts.
• Files shared from OneDrive, SharePoint or Google Drive.

If you find payment instructions, call the recipients on a number you already hold. Our guides to business email compromise and vendor invoice fraud cover what to do if money has moved.

Restore sending

Once the account is secure, remove it from Microsoft's Restricted entities page. Microsoft says restrictions should normally lift within one hour, and no longer than 24 hours. Don't unblock it first: an account that's still compromised will be blocked again.

Tell people

The NCSC advises telling contacts you were hacked and suggesting they "treat any recent messages sent from your account with suspicion" (NCSC). Use a phone call for anyone who may have received a payment request. Change the password on any other service where the user reused it, and check accounts that send password resets to this mailbox.

Report it

If money was lost, contact your bank immediately and report it to the authorities. In the US, that's the FBI's Internet Crime Complaint Center at ic3.gov. Keep the original malicious messages with full headers; the Email Header Analyzer shows where a message really came from.

How do you stop it happening again?

Microsoft's default alert policy "User restricted from sending email" notifies admins when an account is blocked. Make sure it's on and goes to someone who reads it. Our guide to mail flow rules for security in Microsoft 365 shows how to turn off external auto-forwarding and where a rule adds to it.

Next steps

1. Check every mailbox for external forwarding and unexpected inbox rules today. It takes minutes and often finds old problems.
2. Turn on MFA for every account, starting with finance, executives and admins.
3. Write down the response steps above, with who does each one, so nobody improvises during an incident.
4. Reduce the phishing that leads to compromise. iBlockSpam filters phishing, spoofing and malware at the MX before it reaches Microsoft 365, Google Workspace or cPanel mailboxes; see how it works.

Browse our other phishing and threat guides.