Short answer
Attackers who get into an email account often leave a quiet back door: an automatic forwarding address, a filter or inbox rule that forwards, archives or deletes certain messages, or a delegate who can open your mailbox. These settings survive a password change. In Gmail, check Settings → See all settings → Forwarding and POP/IMAP, Filters and Blocked Addresses and Accounts and Import. In Outlook.com, check Settings → Mail → Forwarding and IMAP and Rules. Delete anything you didn’t create — after you have secured the password and signed out other sessions.
Why these settings matter
A forwarding address keeps sending copies of your mail to the attacker even after you have taken the account back. Filters and rules are used to hide what is happening: messages from your bank, or containing words like “security”, “password” or “verify”, are moved to Archive, Trash or a folder you never open. That is how an attacker can reset your other accounts — social media, shops, payment apps — without you ever seeing the emails.
Where to look in Gmail and Outlook.com
| What to check | Gmail | Outlook.com |
|---|---|---|
| Automatic forwarding | Settings → See all settings → Forwarding and POP/IMAP → Disable forwarding, and remove unknown addresses | Settings → Mail → Forwarding and IMAP → Disable forwarding |
| Filters and rules | Settings → See all settings → Filters and Blocked Addresses → Delete | Settings → Mail → Rules → ⋯ → Delete rule |
| Blocked senders | Same tab: unblock bank or security senders you never blocked | Settings → Mail → Junk email → Blocked senders |
| Someone else with access | Accounts and Import → Grant access to your account → Delete | Microsoft account → Security → Recent activity |
| Send-as, signature, auto-reply | Accounts and Import → Send mail as; General → Signature and Vacation responder | Settings → Mail → Compose and reply; Automatic replies |
Do it in this order
- Secure the account first from a clean device: a new password, then sign out of other sessions (Google Account → Security → Your devices; Microsoft → Sign out everywhere).
- Then remove forwarding, filters, rules and delegates. If you do it while the attacker is still signed in, they can simply put them back.
- Check the recovery phone, recovery email and two-step verification methods.
- Search the whole mailbox — including Archive, Trash and Spam — for password-reset or “new sign-in” emails from other services, and secure those accounts too.
- Tell your contacts if the account sent messages you didn’t write.
Work and school accounts
On Microsoft 365 or Google Workspace accounts, the organisation may block or monitor forwarding to outside addresses, and some rules are only visible to administrators. Report the takeover to your IT team so they can check what was created during it.
If you’re locked out
If the attacker changed the password and recovery details, take the account back through the official route first: hacked Google account, hacked Microsoft or Outlook account or hacked Yahoo account. Then come back to this checklist. If several accounts fell at once, the cause may be malware — see session hijacking and cookie theft. Our hacked account recovery service works only through official channels.
Frequently asked questions
Does changing my email password remove forwarding rules?
No. Forwarding addresses, filters, inbox rules and delegates stay until you delete them, which is why attackers use them as a back door.
How do I know if my Gmail is being forwarded?
Open Settings → See all settings → Forwarding and POP/IMAP. If an address is listed and forwarding is enabled, your mail is being copied there. Also check Filters and Blocked Addresses for filters that forward messages.
Where are inbox rules in Outlook.com?
Settings → Mail → Rules. Delete any rule you didn’t create, especially ones that forward, archive or delete messages.
What is mail delegation in Gmail?
It lets another Google account read, send and delete your mail. Check Accounts and Import → Grant access to your account and delete anyone you don’t recognise.
Sources: Gmail Help — automatically forward Gmail messages, Gmail Help — create rules to filter your emails, Gmail Help — delegate and collaborate on email, Microsoft Support — turn automatic forwarding on or off in Outlook, Microsoft Support — manage email messages by using rules in Outlook, Google Account Help — secure a hacked or compromised account