Is Your Business Email Account Hacked? Signs to Check Now

Attackers want business email because it gives them money, data and control. From one inbox they can send fake invoices, reset other passwords and read private client details.

Most email hacks do not look dramatic. The attacker does not delete everything or change your name. They log in quietly, read your mail and wait for the right moment, such as a large payment.

In India, a common pattern is a mail that looks like it comes from a known supplier or from the owner, asking to send payment to a "new" bank account or by UPI. Because the mail comes from a real account, people trust it.

This is why spotting the signs your business email account is hacked early matters so much. The sooner you notice, the less time the attacker has.

The main signs are unusual sign-ins, emails you did not send, rules or settings you did not create, missing messages and complaints from contacts. Use the table below to check each one.

One sign alone is enough reason to check properly. Do not wait to see a second one.

Signs your staff may notice first

Often, the owner is not the first to notice. An accountant may see a strange payment request. A sales person may hear from a client that "your email asked me to pay a different account". Tell staff to report these things the same day, even if they feel unsure.

Forwarding rules are dangerous because they keep sending copies of your emails to the attacker even after you change your password. Many owners miss them because they never look at mail settings.

An attacker who gets in once can create a rule such as: "forward every email with the word invoice or payment to this outside address". Another common trick is a filter that moves replies from a certain client to Trash or Archive, so you never see them.

• Open your email settings and look at forwarding addresses.
• Check filters or rules for anything you did not create.
• Look for rules that delete, archive or mark mail as read.
• Check rules that mention words like invoice, payment, bank or transfer.
• Remove any outside forwarding address you do not recognise.
• Ask your email admin to check rules for every staff mailbox, not just yours.

Check from a clean device: review recent sign-in activity, sent mail, forwarding rules, recovery details and connected apps. This takes about half an hour for one mailbox.

1. 1

   Use a clean device

   If you think your laptop may have malware, use another trusted device to check, so you do not type a new password on an infected machine.

2. 2

   Review recent sign-in activity

   In Gmail, open the details link for last account activity. In Microsoft 365, check the account sign-in activity page. Look for unknown places, devices or times.

3. 3

   Check the Sent and Trash folders

   Look for emails you did not write, especially to clients, suppliers or your accounts team.

4. 4

   Check forwarding and filters

   Open mail settings and look for forwarding addresses, rules and filters you did not create.

5. 5

   Check recovery details

   Make sure the recovery phone number and backup email are still yours.

6. 6

   Check connected apps

   Review third-party apps and sites with access to your account. Remove anything you do not use or know.

7. 7

   Ask your admin to check logs

   If you use Google Workspace or Microsoft 365, the admin console shows more detail, such as sign-ins across all users.

Take screenshots of anything strange before you delete it. These are useful later if you need to file a complaint or explain to a client what happened.

In the first hour, lock the attacker out, stop any money going out and warn the people who may be targeted. Do the investigation after the account is safe.

1. From a clean device, change the email password to a new, long passphrase that you have never used before.
2. Sign out of all other sessions and devices from the security settings.
3. Turn on two-step login, using an authenticator app if possible.
4. Remove unknown forwarding rules, filters, recovery details and connected apps.
5. Call your bank and accounts team at once if any payment request went out or a payment was made.
6. Warn key clients and suppliers by phone that any recent bank detail change from your email is not real.
7. Change passwords of other accounts that use the same password or could be reset from this email.
8. Report to your email admin or IT partner so they can check other mailboxes.

If money has been lost through online fraud, report it quickly to the National Cyber Crime Helpline 1930 or on the cybercrime.gov.in portal, and inform your bank. Speed can help in freezing the transfer.

If your website was also affected, our guide on what to do when your website is hacked covers the steps for that side.

Most business email accounts are hacked through phishing pages, reused passwords from old leaks, or malware on a device. Knowing the cause helps you close the right door.

Phishing is the most common starting point. Our phishing protection training teaches staff to spot fake login pages and payment requests. For passwords, see our simple password security policy template.

When people leave the company, their email access should end the same day. Our employee offboarding security checklist lists every account to close.

Protect business email with two-step login, unique passwords, blocked outside forwarding, regular rule checks, staff training and proper domain email records. Together these close most common routes.

SPF, DKIM and DMARC records do not stop someone from logging in with a stolen password. But they make it harder for attackers to send fake mails that pretend to come from your domain. Our SPF, DKIM and DMARC setup guide explains how they work.

Make one payment rule for the whole team

Write a simple rule: no new bank account or UPI ID is used for payment until someone confirms it by phone, using a number already saved, not the number in the email. This one habit blocks most email payment fraud, even if an inbox is hacked.

Get professional help if money was sent, client data may be exposed, many mailboxes are affected, or you cannot find how the attacker got in.

A proper check looks at sign-in logs for all users, mail rules across the company, connected apps, devices and the domain settings. It also confirms that the attacker no longer has any way back in.

• Payment was made to a fake account after an email request
• You cannot get back into the account at all
• The same problem comes back after you changed the password
• Several staff mailboxes show strange rules or sign-ins
• Client or customer personal data was in the affected mailbox

Personal data in email may bring duties under India's Digital Personal Data Protection Act, 2023, so it is wise to take advice early. Our security monitoring service can watch for unusual activity after the clean-up, and a security audit can find other weak points.

SI Cyber helps you lock out the attacker, find how they got in, check every mailbox and set up protections so it does not happen again, all explained in simple language.

We work with Google Workspace, Microsoft 365 and common hosting email. We also check related risks, such as your website, domain DNS and the accounts that use your email for password reset. Our wider cybersecurity for small business service covers these areas together.

SI Cyber is powered by Shivah Web Tech, with 11+ years of experience. Our team works Monday to Friday, 9:30 to 6:30 IST, from Mohali, and we offer 24x7 emergency support for urgent issues. Contact us for help today.

Related Pages