3 September 2026LANTEK Computers
If you are worried right now, check these seven things in this order. Explanations follow.
- Inbox rules. Anything you did not create, especially anything that forwards outside the company or moves messages into an unusual folder.
- Forwarding on the mailbox itself. Set separately from rules, so check both.
- Sent items and deleted items. Messages you did not write. Also look for an empty sent folder, which is itself a finding.
- Recent sign-in activity. Times and locations that are not you.
- Recovery details. Alternate email addresses and phone numbers you do not recognise.
- Mailbox delegation. Anybody who has been granted access to your mailbox.
- App passwords and connected applications. Anything authorised that you did not authorise.
Then go to the bottom of this article for what to do if any of them turns something up.
Why there is nothing obvious to notice
Nothing breaks when somebody reads your mail. No warning, no lockout, no slowdown. They sign in the ordinary way with a password that works, and to the systems involved that is a person signing in.
So the signs are not symptoms of damage. They are traces of the housekeeping somebody does when they intend to keep access, and that is what makes them worth knowing.
The signs, and what each one means
An inbox rule you did not create
This is the most reliable indicator there is. If you find a rule you did not make, treat it as confirmed rather than suspicious.
The shapes to look for: anything forwarding to an address outside your business, anything filing messages containing words like invoice or payment or bank into a folder you never open, and anything sending mail from a particular sender straight to deleted items. The purpose of the last two is to hold a conversation on your behalf without you seeing the replies.
Rules with blank names, or names that are a single character or a full stop, are a specific tell. They are named that way to be easy to overlook in a list.
Forwarding set on the mailbox rather than in a rule
Worth its own item because it lives somewhere different and people check rules and stop. A mailbox can forward everything at the account level, independently of any rule you would see in your mail client. Ask whoever administers your mail to check this specifically.
Things in sent items that you did not send
Obvious when you find it. What people miss is the inverse: a sent folder that is emptier than it should be, or a period with nothing in it. Somebody who sent a message from your account and tidied up after themselves leaves a gap rather than an addition.
Same for deleted items. A message in there that you never received and never deleted means somebody received it and dealt with it.
Replies to conversations you never saw
Somebody telephones about a quotation you did not send. A supplier answers a question you did not ask. A client confirms new banking details you never gave them.
This is the point at which most compromises are actually discovered, and by then the correspondence has been going for a while. If somebody outside the business refers to an exchange you have no memory of, do not assume you forgot.
Sign-in activity that is not you
Most mail systems can show recent sign-ins with times and rough locations. You are looking for a sign-in from somewhere you were not, at a time you were asleep, or two sign-ins far apart within an hour.
One caution so you do not chase ghosts: location data is approximate and mobile networks routinely place you in another city. What is meaningful is a different country, or a pattern that repeats, not a single odd entry.
A recovery address or phone number you do not recognise
Quiet and serious. This is somebody arranging to be able to reset the account later, after you change the password. It is the step that turns a moment of access into ongoing access.
Somebody else has permission on your mailbox
Delegation is a legitimate feature and plenty of businesses use it deliberately. What matters is whether every entry is one you know about. An unexpected one means access that survives your password change entirely.
Multi-factor prompts you did not trigger
If you have multi-factor authentication on and you receive an approval request out of nowhere, that is somebody holding your working password right now. Do not approve it. Change the password immediately, from a different device.
Repeated prompts are a deliberate technique, on the assumption that somebody will eventually approve one to stop the noise.
Things that worry people and usually should not
Being clear about these saves a lot of unnecessary alarm.
A password reset email you did not request. Someone tried and failed. Worth changing the password and worth noting, but on its own it means the front door held.
Spam that appears to come from your own address. Sender addresses are trivial to forge and this usually involves no access to your mailbox at all. It is a sending reputation problem, not a compromise. Check the sent folder to be sure: if the messages are not there, they did not go from your account.
A contact saying they got something odd from you. Check sent items first. Frequently it is the forgery above, or their own mailbox rather than yours.
What to do if you find something
In this order, and quickly.
One. Change the password from a device you trust, and sign every session out. A password change alone does not always end an active session, and that is the step people miss.
Two. Turn on multi-factor authentication if it is not on. This is what stops the same password being used again an hour from now.
Three. Remove the rules, forwarding, recovery details and delegations you found. Write down what they were before you delete them.
Four. Freeze banking detail changes across the business, and telephone to verify any made in the last month using a number you already held.
Five. Tell whoever supports your systems, and tell the business. Other mailboxes may be affected, and the person most at risk now is whoever received mail from your account while it was open.
Six. Take advice on whether this is notifiable. If personal information was reachable, that question is a legal one.
The full first day, including what not to do, is in what to do in the first 24 hours. Why somebody would sit in a mailbox reading rather than acting is in how business email compromise actually works.
The uncomfortable part
Everything above is discovered by looking. If nobody looks, nothing is found, and the average compromise is discovered by a third party asking a question rather than by the business noticing.
That gap between access and discovery is where the whole cost accumulates, and closing it is the argument for somebody watching sign-in behaviour rather than waiting for a symptom. That is what 24/7 Monitoring and Response is for, and whether your addresses and passwords are already in circulation is what the free dark web scan answers.