Forwarding Rules Set Up by Someone Else

A rule nobody remembers making

Somebody signs in to the business email with a stolen password. They change nothing you would notice. They add one rule, and leave.

The rule copies certain messages to an address outside the business, such as anything mentioning an invoice, a payment or a transfer. Some forward everything.

The mailbox keeps working normally. Mail arrives, replies go out, and nobody sees the copies leaving.

Weeks later, a customer receives an email about a change of bank details, timed to an invoice they were expecting and written in your usual tone.

How the password gets out

• A fake sign-in page, reached from an email about a shared document.
• A reused password from another site that was later compromised.
• A guessed password, tried automatically against the webmail login.
• A shared computer where the browser remembered the login.
• An infected computer recording what is typed.

The first is the one that catches careful people: the page looks exactly like a webmail login, and nothing seems wrong after the password is typed.

Why a rule rather than a takeover

An attacker who changed the password would be noticed within the hour. A rule lets them read for weeks without being seen.

They learn who pays the business and whom it pays, how invoices are worded, when they go out and who signs them.

Some add a second rule that hides certain replies in a folder nobody opens, so a customer's question about the new account never reaches you.

The payment request may come from your own account or from a lookalike address one letter different, and it arrives at exactly the right moment.

Where rules and forwarding hide

Rules are stored with the mailbox on the mail server, so they run whether or not your computer is on, and they rarely show on a phone.

In desktop Outlook, look under Rules and Alerts. In the web version of Outlook that comes with Office 365, check the inbox rules and the forwarding option.

In Gmail and Google Apps for Work, check Forwarding and POP/IMAP, the filters, and any accounts that have been granted access to the mailbox.

Mail hosted with your website has forwarders and filters in the hosting control panel, and the webmail program may have rules of its own.

A five-minute look once a month, in each mailbox that handles money, is enough to catch one.

What a hostile rule looks like

Attackers' rules tend to have short or meaningless names: a single full stop, a few random letters, or a copy of an ordinary rule's name.

Look for anything that forwards to an outside address, deletes messages, or marks mail as read or moves it out of the inbox based on words like invoice, payment, bank or wire.

If nobody in the office can explain a rule, treat it as hostile until shown otherwise.

A worked example

A stall in a downtown food hall makes curry and roti, and sells frozen roti to three local grocers, invoiced by email and usually paid by bank transfer.

In March, the bookkeeper at one of the grocers got an email from the stall's own address saying its bank account had changed, with new details for her latest invoice.

She phoned the stall to check, because nobody there had mentioned a new bank.

The owner found two rules nobody had made. One forwarded every message mentioning an invoice or payment to an outside address; the other moved replies from the grocers into the RSS Feeds folder.

The trail led to an email weeks earlier, apparently from a produce supplier, linking to a shared invoice. The owner had typed the email password into the page it opened.

Both rules were deleted, the password changed from another computer, every other session signed out and two-step verification switched on. Each grocer got a short call: bank details never change by email alone.

If you find one

Before deleting a rule, note what it did and where it sent mail; that shows what the attacker was after.

Change the password from a different computer, in case the usual one is infected, and sign out every other session.

Check the mailbox's other settings too: the recovery email and phone, addresses mail can be sent as, the reply-to address, and anyone with delegated access.

Then look through the sent and deleted folders for messages you did not write, which show who has already been contacted.

Tell the people who pay you

Customers and suppliers in the mailbox may get convincing messages for weeks after the rule is gone, because the attacker has copies of the conversations.

Phone the ones with open invoices rather than emailing them, and agree a simple rule: any change of bank details is confirmed by phone, at a number you already have.

Put the same line on your invoices. It costs nothing and gives customers permission to doubt a message that seems to come from you.

Two-step verification

A rule can only be added by someone who can sign in. Two-step verification asks for a code from a phone or an app as well as the password, so a stolen password alone is not enough.

Office 365 and Google Apps for Work both offer it, and it is worth switching on for every mailbox that handles money.

The counter-case

Most forwarding is innocent. A sales address sent on to the owner's phone, or a former employee's mail redirected to a colleague, is ordinary and useful.

A business whose email holds no invoices is a less attractive target, though its mailbox can still be used to send fraud to its contacts.

And no check replaces the phone call: a customer who confirms bank details by phone stops this fraud even when the mailbox has been read for months.

For any mailbox that sees invoices, though, the advice stands: check the rules and forwarding, delete what nobody made, and put the account behind two-step verification.

Before the next invoice goes out

1. Open the rules in every business mailbox.
2. Check forwarding settings and delegated access.
3. Delete anything nobody can explain.
4. Change passwords from a clean computer.
5. Turn on two-step verification where offered.
6. Phone clients with open invoices.
7. Add a bank details line to invoices.

Step six is the one that protects the money. Rules can be found and passwords changed, but the attacker may still hold the conversations, and only a call to a known number breaks the chain.

Control of the account that recovers your website and domain matters for the same reason, as covered in a website admin email at a personal Gmail account.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.