Check your mailbox for rules you didn't create

What to look for

Attackers commonly add rules that:

• Move emails from certain people to an odd folder, such as Archive, RSS Feeds or Conversation History, and mark them as read.
• Delete messages containing words like “invoice,” “payment,” “wire” or “hacked.”
• Forward copies of everything to an outside address.

How to check in Outlook

1. Open your rules. In Outlook on the web, go to Settings, then Mail, then Rules. In the Outlook app, look for Rules under the Home or File menu.
2. Read every rule. Ask of each one: did I create this, and do I know what it does?
3. Check forwarding. In Outlook on the web, go to Settings, Mail, Forwarding. Make sure nothing is being forwarded that you did not set up.
4. Look in unusual folders for recent messages you never saw.

If you find something

Do not just delete it. Tell IT first, because a rule you did not create means someone else has been in your mailbox, and they may still have access. Your password needs changing and every session needs signing out, from a device you trust.