Compromised mailboxes can hide forwarding rules that send emails elsewhere. Bellwether IT manages Microsoft 365 security so these issues stay caught and cleared.

Compromised Mailboxes and Forwarding Rules

A bookkeeper opens a vendor invoice email in Microsoft 365. The next day the same message lands in an outside account. The owner never sees the change. Hidden Outlook forwarding rules make this possible after a mailbox is compromised.

Good IT already watches for these rules. They check Microsoft 365 tenant settings on a regular schedule and remove anything added without approval.

What Proper IT Management Covers

Your IT company should track login activity from every device. They review rule changes in mailboxes used by the bookkeeper and the accounts payable team. They also check devices that leave the office, such as a laptop an employee takes home.

When a rule appears that forwards every invoice to an unknown address, the right provider removes it at once and resets the mailbox permissions.

  • Login from an unfamiliar location at odd hours
  • New forwarding rule created outside normal business hours
  • Messages marked as read without the owner opening them
  • A laptop that left with a former employee still syncing mail

These checks happen in the background. The owner only hears about them if something needs attention.

Indicators Your IT Partner Falls Short

If your current provider never mentions mailbox rules, that is a clear sign. They may handle basic password resets but leave deeper Microsoft 365 settings untouched. A compromised mailbox can stay that way for weeks.

The gap shows up when a vendor asks why their invoice never reached the bookkeeper. At that point the damage is already done.

Bellwether Approach to Email Security

We review Microsoft 365 rule settings across all mailboxes every week. We tie those checks to device inventory so a laptop that leaves the office does not keep old rules active.

What we do We monitor Microsoft 365 mailboxes for unauthorized forwarding rules and remove them before invoices or client data get rerouted.

This work stays with us. The owner focuses on the business while we keep the mail clean.

If your current IT setup leaves these gaps open, reach out.