5 Warning Signs Your Business Email Has Been Compromised

Article summary: A compromised business email account can go undetected while attackers quietly monitor messages and look for opportunities to commit fraud. Recognizing warning signs, such as suspicious inbox rules and unfamiliar sign-in activity, helps businesses identify threats early. Acting quickly can prevent financial losses, protect sensitive information, and preserve customer trust.

Most compromised business email accounts don’t come with an obvious warning. There’s no ransom note or flashing alert. Instead, an attacker quietly gains access, reads messages, and waits for the right opportunity.

That access can be costly. By monitoring invoices and client conversations, cybercriminals can impersonate trusted contacts, redirect payments, or steal sensitive information.

While email spam protection helps block malicious messages, it can’t always prevent someone from accessing an account with stolen credentials.

Recognizing the warning signs is an important part of protecting your business. Here are five to watch for.

Why a Compromised Business Email Costs So Much

Business email compromise (BEC) caused more than $3 billion in reported U.S. losses in 2025.

According to the FBI’s 2025 Internet Crime Report, the agency received 24,768 BEC complaints, with reported losses exceeding $3.04 billion.

BEC scams involve criminals impersonating trusted business contacts to trick employees, customers, or vendors into sending money or sensitive information.

A compromised account makes these scams especially convincing. Messages come from a legitimate email address and may reference actual projects, invoices, or conversations.

Attackers often gain access through phishing or stolen passwords, including credentials reused across multiple accounts. Once inside, they may quietly monitor communications until an opportunity arises.

For a small business, a single fraudulent payment can cause significant financial damage. Recognizing the warning signs early can help limit the losses.

5 Signs Someone Else Is in Your Inbox

1. Inbox Rules You Didn’t Create

Attackers can use inbox rules to secretly forward messages to an outside address or move incoming replies into folders you’re unlikely to check.

Microsoft identifies suspicious inbox rules as a warning sign of a compromised Microsoft 365 account. Pay particular attention to rules that redirect messages to unfamiliar addresses or folders, such as RSS Subscriptions.

Our guide to spotting silent email redirection after a breach explains how this tactic works.

2. Unfamiliar or Missing Sent Messages

Check your Sent folder for messages you don’t remember sending. Attackers may use compromised accounts to send fraudulent emails, then delete the messages to hide their activity.

An unusually empty Sent folder can also warrant investigation. The Federal Trade Commission recommends checking sent messages and deleted items for suspicious activity.

3. Contacts Asking About Emails You Never Sent

Sometimes the first warning comes from a customer or vendor. Someone might call to confirm updated banking information or ask about an invoice you never sent.

Don’t dismiss these reports. They could indicate that someone is using your account to impersonate your business. If one contact received a suspicious message, others may have received similar emails.

4. Unexpected Sign-In Alerts or Account Lockouts

Sign-in notifications from unfamiliar devices or locations, unexpected password reset requests, and repeated account lockouts can indicate suspicious activity.

These alerts don’t always mean an account has been compromised, but they deserve immediate attention. Attackers may also steal active login sessions to bypass normal authentication.

Our article on adversary-in-the-middle attacks explains how criminals can hijack authenticated sessions.

5. Unexplained Changes to Account Settings

Attackers may change account settings to maintain access or make fraudulent messages appear legitimate. Watch for altered email signatures, unfamiliar recovery information, or authentication methods you didn’t add.

These changes can be easy to overlook, and some may allow attackers to regain access even after a password reset. That’s why reviewing account settings is an essential part of investigating a suspected compromise.

What to Do If You Spot a Warning Sign

Act quickly if you suspect an email account has been compromised. Changing the password may not be enough, especially if an attacker has established other ways to access the account.

Microsoft’s incident response guidance recommends taking these steps:

1. Block unauthorized access and reset the password to a strong, unique one.
2. Revoke active sessions to sign out anyone currently using the account.
3. Remove unfamiliar multifactor authentication methods and unauthorized app permissions.
4. Delete suspicious inbox rules and automatic forwarding settings.
5. Review sign-in and audit logs to determine what the attacker accessed or changed.

Once the account is secured, notify affected clients and vendors. Warn them about suspicious messages or payment requests they may have received.

The FBI recommends verifying payment changes through a separate communication channel, such as calling a trusted phone number.

If money has already been transferred, contact your bank immediately and report the fraud to the FBI’s Internet Crime Complaint Center (IC3).

Having an incident response checklist prepared in advance helps your team respond quickly and minimize the damage.

Is Someone Quietly Watching Your Business Email?

A compromised email account can go unnoticed for weeks. Regularly reviewing inbox rules, sent messages, sign-in activity, and account settings helps you catch suspicious behavior before it leads to serious financial or data loss.

Sound Computers helps Connecticut businesses strengthen email security, monitor for suspicious activity, and respond quickly to potential threats. Our team focuses on addressing the underlying problem, not just applying a temporary fix.

Concerned about your business email security? Contact Sound Computers at (860) 577-8060, reach out online, or email info@soundcomputers.net to schedule a consultation.

Article FAQs

How do I know if my business email has been hacked?

Watch for unfamiliar inbox rules, suspicious sent messages, or contacts asking about emails you never sent. Unexpected sign-in alerts and unexplained changes to account settings may also indicate unauthorized access.

Is changing my password enough after an email compromise?

Not necessarily. Attackers may leave behind forwarding rules, active sessions, or unauthorized authentication methods. Revoke active sessions, remove suspicious settings, and review account activity to ensure access has been secured.

What is a business email compromise?

Business email compromise (BEC) is a scam in which criminals impersonate trusted business contacts using compromised or spoofed email addresses to steal money or sensitive information. According to the FBI’s 2025 Internet Crime Report, reported BEC losses exceeded $3 billion.