Audit Mail Forwarding Rules After a Household Account Scare

After suspicious activity on a shared household email account, inspect mailbox forwarding, filters, rules, delegates, and connected apps before declaring recovery complete. An intruder may create a rule that quietly forwards security messages or hides bills and password-reset notices. Changing the password is important, but it does not by itself document or remove every persistence route.

Treat the mailbox as potentially exposed until the account owner has used the provider's official security review. Work from a trusted, updated device. If the provider reports an active compromise, follow its recovery flow rather than relying on links in unexpected email.

Preserve facts, then remove unwanted access

First record what triggered concern: an alert, unfamiliar sent message, changed setting, or report from a household member. Capture timestamps and exact sender addresses without forwarding suspicious content around the home. Do not click links or open attachments merely to investigate.

Use a bookmark or type the provider's known address. Review recent sign-ins, active sessions, recovery methods, delegates, app passwords, third-party connections, forwarding destinations, and mailbox rules. Names that look ordinary can still hide actions such as marking messages read, moving them to archive, deleting them, or forwarding a copy.

Take screenshots of unfamiliar settings before removal if doing so does not expose private correspondence. Then remove unauthorized rules and access, change the password to a unique one, sign out unfamiliar sessions, and strengthen multifactor authentication using the provider's supported options. Rotate recovery codes if the provider recommends it. If a connected service used the same password, change that service separately rather than creating another shared password.

The Cybersecurity and Infrastructure Security Agency describes threat actors using email forwarding rules to collect information. Its advisory addresses organizational cloud email, but the operational lesson is useful at home: forwarding and inbox rules deserve an explicit inspection after compromise.

Restore household workflows without exposing private mail

Identify household functions that rely on the mailbox: utilities, internet service, rent notices, insurance, deliveries, smart-home administration, or subscriptions. Ask the responsible resident to verify each service through its official site. Check whether contact details, billing settings, authorized users, or recovery information changed.

Do not give every resident full mailbox access simply to speed the review. Assign service checks without sharing the inbox password. Where a provider supports individual users, delegates, or role-based access, prefer those over one credential. A personal message discovered during the audit remains private unless it is necessary to resolve the incident.

Create a dated incident note that records actions, not secrets. Include which rules were removed, which sessions were closed, which services were checked, and what remains unresolved. Keep full security exports or private screenshots in restricted storage. If money, identity documents, or tax information may have been exposed, use the relevant provider's fraud process and appropriate government reporting channel.

How HomeCo helps

HomeCo can coordinate the response without becoming the place where credentials are stored. Create private or appropriately scoped tasks for the internet bill, utility portal, smart-home account, and subscription review. Give each task an owner and a simple status such as not checked, checked, or escalated.

Use an announcement to tell residents which household notices may have been delayed, without repeating sensitive message content. Schedule a follow-up after the provider's recent-activity window has been reviewed. HomeCo's guide to a two-factor authentication backup for household accounts can help the household rebuild access after the immediate audit.

FAQ

Does changing the email password delete forwarding rules?

Do not assume it does. Review and remove rules, delegates, connected apps, and forwarding settings directly, then follow the provider's security checklist.

Should every housemate review the inbox?

No. The account owner or authorized maintainer can inspect mailbox settings while other residents verify their assigned services. This limits unnecessary exposure to private messages.

What if an unknown rule looks harmless?

Record it, inspect its conditions and actions, and remove it if nobody authorized it. If you cannot determine its origin, contact the email provider through an official support route.