The Hidden Email Rule That Hides a Hacker in Your Inbox

The rule named after a single period

When someone breaks into a business mailbox, the first thing they do isn’t steal anything. It’s set up housekeeping. And the tool they reach for is the same one you use to sort newsletters: an inbox rule.

The classic looks like this. A rule named ‘.’ or ‘..’ or just a single space, because a blank name is hard to spot in a list and easy to scroll past. The rule says: if a message contains the word invoice, or payment, or wire, or bank, move it to the RSS Feeds folder and mark it as read. Some versions forward a copy to an outside Gmail address first.

Why RSS Feeds? Because it exists in every Outlook profile, nobody has ever opened it, and it doesn’t look suspicious sitting there. Same trick with Conversation History or Archive subfolders buried three levels down.

Now here’s what that rule buys the attacker. Your bookkeeper’s mailbox is compromised. Every email about money silently skips her inbox. The attacker reads it from the RSS folder, decides how to respond, and replies as her. She never sees the original. She never sees the reply. She has no idea a conversation is happening in her name until a client calls asking why the wire didn’t clear.

This is how the money actually leaves

Business email compromise is consistently one of the most expensive categories of cybercrime, and it’s not because of clever malware. It’s because of patience plus a mail rule.

The pattern is always roughly the same:

They get in, usually through a phishing page or a stolen session token.
They set the rule and go quiet, sometimes for weeks.
They read until they find a real invoice thread with a real client who owes you real money.
They wait for the moment the payment is due, then send updated banking details from your actual account, inside the actual thread, with your actual signature block.
The client pays. To them. And because it came from your legitimate mailbox, there’s nothing for a spam filter to catch.

The client thinks you scammed them. You think they lost their mind. The money is in a mule account within the hour and gone offshore by the next day. Recovery odds drop sharply after about 72 hours, which is why the timeline of noticing matters so much.

Go check your tenant. Seriously, right now.

This is one of the highest value fifteen minutes you’ll spend on security this month, and it costs nothing.

The quick manual check

In Outlook on the web, click the gear, then Mail, then Rules. Look for anything you didn’t create, anything with a blank or nonsense name, and anything that moves mail to RSS Feeds or forwards to an outside address. Do this for the mailboxes that matter most: owner, bookkeeper, anyone who talks to clients about money.

The thorough check

If you have admin access, PowerShell will tell you across the whole tenant in one shot. Connect to Exchange Online and pull every inbox rule for every mailbox, then eyeball anything with a ForwardTo, RedirectTo, or a MoveToFolder pointing somewhere odd. An IT provider can run this in a couple of minutes and hand you the list.

The one people forget

Rules aren’t the only hiding spot. Also check:

Mailbox forwarding set at the account level (separate from rules, and it doesn’t show up in the Outlook rules list).
Mailbox delegates and folder permissions. Granting someone else read access to the inbox survives a password reset.
Connected apps and OAuth grants, which also survive a password reset.
Registered MFA methods. Attackers love adding their own phone number or authenticator so they can get back in cleanly later.

Turn off the thing that makes it possible

Microsoft 365 has an outbound spam filter policy with a setting for automatic forwarding. Set it to Off, which blocks users from auto-forwarding mail outside your organization entirely. Very few small businesses have a real reason to allow it, and the ones that do can be handled with an exception.

A few more that pay for themselves:

Turn on the built-in alert policies in the Microsoft 365 Defender portal, especially ‘Creation of forwarding/redirect rule’ and ‘Suspicious email sending patterns.’ Send them to an address a human checks daily.
Enable mailbox auditing and make sure the unified audit log is on. If it’s off, you’ll have nothing to investigate with when you need it most.
Conditional access rules that block sign-ins from countries you don’t do business in. Cheap and effective.
Phishing-resistant MFA. Number matching at minimum, passkeys if you can get there. Standard push approval is getting worn down.

The process fix that beats all of it

Technology will not fully solve this one, because the attacker is using your legitimate account. So put a rule in place that doesn’t depend on email at all:

Any change to payment details gets verified by phone, using a number you already had on file, before a dollar moves. Not a number from the email. Not a reply to the thread. A number from your records, dialed by a person.

Write it down, tell your team, and tell your clients you do it. Then make sure whoever handles payments knows they will never get in trouble for calling to confirm, even if it turns out to be nothing. The whole scam runs on people not wanting to look paranoid over what seems like a routine email.

If you find one

Assume the mailbox is compromised, not just misconfigured. Delete the rule, revoke all active sessions, reset the password, re-register MFA from scratch, and review app permissions and delegates. Then run a message trace to see what was sent while they had access, and call anyone who got a money-related email in that window. Phone call, not email. If any payment details were touched, notify your bank immediately and file with the FBI’s IC3 the same day.

We run this exact audit for small businesses from Delray Beach to West Palm Beach, and it turns up something more often than anybody expects. If nobody has checked your mail rules and forwarding settings this year, let’s check them. Always happy to troubleshoot.