How Hackers Keep Access to Your Email After You Change the Password
When a business email account is hacked, the first reaction is to change the password. That is necessary, but it is often not enough. Attackers who have been in an account for even a short time may have set things up so they can keep reading mail, or come back, after the password changes.
Why a new password may not remove every form of access
A password is only one way in. Once an attacker has signed in, they can leave other doors open that do not depend on it. Knowing where to look is the difference between a cleanup that works and one that gives a false sense of safety.
An existing session may still work
When you sign in, the service gives your device a sign-in token so you do not have to type the password each time. A token an attacker obtained, for example through a fake login page, can keep working after the password changes, until it expires or is revoked. Microsoft’s security guidance for incidents notes that revoking sessions may not cut off access immediately, and that disabling the account briefly is the safest way to stop someone who is actively in it.
Forwarding rules can keep sending out your email
A common trick is a hidden inbox rule or forwarding setting that quietly copies incoming mail to an outside address, or moves messages into a folder you never look at. It keeps working after a password change. Check:
- Inbox rules, including hidden ones, which an administrator can list with the right tools.
- Mailbox forwarding settings.
- Any rule that deletes, hides or redirects messages, especially about invoices, security alerts or the attacker’s own activity.
A connected app may have permission to read the mailbox
Attackers sometimes trick people into approving an app with access to their email, or add one themselves. Because the permission belongs to the app and not the password, it can survive a password change. Review the apps with access to the account and remove any you do not recognize.
Someone else may have mailbox permissions
An attacker with enough access may grant another account permission to read or send from the mailbox. Check who has access to the mailbox, including delegates and permissions to send as the user.
Check recovery methods after you change the password
Look at the phone numbers, backup email addresses and multi-factor authentication methods on the account. Attackers often add their own so they can pass later security checks or reset the password again. Remove anything you did not set up, and re-register your own methods.
How to secure a compromised email account
Do this in order, and treat the account as compromised until every step is done:
- Act quickly, and if you can, temporarily block sign-in to the account.
- Change the password to a long, unique one, from a device you trust.
- Revoke active sessions, so that sign-in tokens stop working.
- Review and remove unknown multi-factor methods, recovery details and registered devices.
- Check and remove forwarding and inbox rules, including hidden ones.
- Review connected apps and permissions, and remove any you do not recognize.
- Check mailbox delegates and roles, and confirm the user has no extra administrator rights.
- Look at the sign-in and audit logs for unusual locations, times and actions.
- Turn on strong multi-factor authentication, preferably an authenticator app or a passkey. See passkeys.
- Watch the account for several weeks afterward.
Much of this needs administrator access and the right tools, which is why it is best handled by your IT provider. Microsoft publishes a step-by-step guide for compromised Microsoft 365 accounts.
Disable or suspend the account
If you cannot be sure an attacker is out, suspending the account during the cleanup is a sound choice. It stops further damage while you work, and you can restore it once it is clean.
What to do about the damage
A hacked mailbox is often used to send phishing emails to your contacts or to change payment details. Tell the people the attacker may have written to, check recent invoices and payment changes by phone, and look for fraud. Our posts on deepfake and impersonation scams and spotting scam emails explain what attackers do next. If customer or patient information was in the mailbox, you may have legal obligations to notify people, so involve an adviser early.
Preventing the next one
Most compromises start with a stolen password or a fake sign-in page. Multi-factor authentication stops many of them, and phishing-resistant methods stop most of the rest. Our Microsoft 365 support covers multi-factor authentication, access policies and protection against account takeover, and our cybersecurity services cover email protection. A free security review looks at how your accounts and passwords are protected today. If you think an account is compromised now, contact us right away.
Frequently asked questions
If I change my password, is the hacker locked out?
Not necessarily. Existing sessions, forwarding rules, connected apps, extra permissions and added recovery methods can all keep working after a password change.
How do I know if someone is forwarding my email?
Check inbox rules and forwarding settings in the mailbox, including hidden rules, and look for mail going to outside addresses. An administrator can list rules and forwarding for the whole account.
Should I turn off the account while cleaning up?
Often yes. Temporarily blocking sign-in stops an active attacker, and you can restore access when the account is clean.
What is the most important step to prevent this?
Multi-factor authentication on every account, preferably with an authenticator app or passkey, since it blocks most stolen-password attacks.
Do we have to tell anyone if our email was hacked?
Possibly. If personal information about customers, patients or employees was exposed, laws in many states require notice. Ask your adviser, and see our post on what to ask a vendor after a breach.
