PanicStation.org
UK USA
uk Technology & digital loss email hacked • email forwarding rule • unknown forwarding address • inbox rules i didnt make • mailbox rules changed • filters i didnt set up • auto forwarding enabled • suspicious email settings • account takeover email • someone accessing my inbox • unexpected sign in alert • emails disappearing • sent messages i didnt send • password reset emails missing • recovery email changed • security settings changed • third party access to email • compromised email account • email rules forwarding to stranger

What to do if…
you discover new email forwarding rules you did not set up

Short answer

Assume your email account has been accessed by someone else: remove the forwarding rules, then immediately secure the account (sign out of other sessions, change password, turn on 2-step verification) from a clean device.

Do not do these things

  • Don’t keep using the same inbox normally “until later” — forwarding rules are often used to intercept password resets.
  • Don’t change settings while you’re clicking through links in suspicious emails — go to your provider by typing the address/app yourself.
  • Don’t reuse an old password or a password you’ve used anywhere else.
  • Don’t assume deleting the rule is enough if it reappears — treat that as ongoing access.
  • Don’t ignore recovery options (backup email/phone) — attackers often change these to regain entry.

What to do now

  1. Use a clean route in. If you can, use a device you trust (or restart and install updates), then open your email provider by typing the address or using the official app — not via email links.
  2. Remove the suspicious forwarding and any “hiding” rules.
    • Delete any forwarding addresses you don’t recognise.
    • Also check for rules/filters that auto-delete, archive, mark as read, or move messages (especially “security”, “password”, “bank”, “invoice”).
  3. Sign out of other sessions and revoke access. Use your provider’s security page to sign out of other devices/sessions and remove any unknown devices. Revoke access for any unfamiliar “connected apps” or third-party mail access.
  4. Change your email password immediately (and make it unique). Do this after removing the rules. If your provider offers it, also change any app passwords/security questions tied to the mailbox.
  5. Turn on 2-step verification (2SV) and lock down recovery options. Confirm your recovery email address and phone number are yours, remove anything unfamiliar, and save backup codes if offered.
  6. Check for misuse and stop the most likely follow-on harm.
    • Look in Sent, Deleted/Trash, and Archive for messages you didn’t send or that look like password resets.
    • If this inbox is used for banking/shopping/benefits/work logins, go to the most important linked accounts and change passwords there too, starting with any that share the old email password.
  7. If this is a work/school account, tell your IT/security team now. Your admin may need to remove rules server-side and review sign-in logs.
  8. Report and contain if fraud is involved.
    • If you received a suspicious email linked to this, forward it to report@phishing.gov.uk (don’t click links or open attachments).
    • If you’ve lost money, suspect fraud, or the compromise is ongoing: England/Wales/Northern Ireland report via the national fraud/cyber reporting service (Report Fraud / Action Fraud). Scotland: contact Police Scotland (101 or their online reporting).
    • If you are in immediate danger, call 999.

What can wait

  • You don’t need to figure out how they got in right now — first stop access and forwarding.
  • You don’t need to message every contact immediately unless you see emails were sent from your account.
  • You don’t need to do a full device “deep clean” right away if you’ve secured the account from a clean route — you can schedule deeper checks after you regain control.

Important reassurance

Finding forwarding rules you didn’t create is a common, fixable sign of account takeover. The goal right now is to cut off access and prevent password resets being intercepted — you can work out the wider impact after you’re back in control.

Scope note

This is first steps only — once your account is stable, you may still want provider support and (for serious fraud/identity issues) specialist advice.

Important note

This guide is general information, not legal, IT, or financial advice. If you can’t keep the rules deleted, can’t regain access, or you suspect fraud is active, use your email provider’s official account-recovery/support and report through the appropriate UK channels.

Additional Resources
Support us