Email Forwarding Rules Can Quietly Keep a Compromised Account Exposed

Look beyond the password

Changing a password is an important response to an account compromise, but it may not remove every way someone can keep access. Email services can have active sessions on several devices, forwarding rules that copy messages elsewhere, connected applications, or recovery details that were changed. These features are legitimate conveniences too, so review them rather than deleting everything blindly.

Run a focused review

Open the account's security page from its official site, check recent sign-in activity, and sign out devices you do not recognize. Inspect forwarding addresses, filters, delegated access, app passwords, and third-party app connections. Remove unfamiliar entries and update recovery contacts. If the same password was used elsewhere, change those accounts to unique passwords and enable multifactor authentication.

Reduce future impact

Keep the email account especially well protected because it can reset other logins. Avoid sharing verification codes, and contact the provider through a verified support route if you cannot restore access. Monitor financial and work accounts if sensitive mail was exposed. For an organization account, follow its incident process promptly; administrators may need to review audit logs and revoke tokens beyond what an individual user can see.

Sources and further reading

• Google Account Help: Make your account more secure
• FTC: Protect Your Personal Information