What you’re seeing
- Inbox rules with odd names such as a single period, ".." or random letters that the user didn't create.
- Replies from clients or vendors go missing, or appear in RSS Feeds, Archive or Conversation History instead of the inbox.
- Emails about invoices, payments or wire transfers are being deleted or moved before the user sees them.
- Copies of messages are being forwarded to an outside address the business doesn't recognize.
- Clients report receiving changed bank details or payment requests appearing to come from this mailbox.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- An attacker obtained the user's password or session token, often through phishing, and signed in to the mailbox.
- The attacker created rules to hide replies from the real user so they can carry on a fraudulent conversation unnoticed.
- Automatic external forwarding is allowed in the tenant, letting rules or mailbox settings send mail outside the organization.
- A malicious third-party app was granted consent to read and send mail on the user's behalf.
- The attacker added their own MFA method or device, keeping access even after a password change.
Why it matters
Hidden inbox rules are the setup step for invoice and wire fraud. While the real user sees nothing unusual, the attacker watches payment conversations, inserts new bank details and suppresses the replies that would expose them. Losses can reach tens or hundreds of thousands of dollars and are often unrecoverable once funds move. Forwarded mail may also contain client personal data, contracts or health and financial information, which can trigger breach-notification and contractual reporting duties.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
If we delete the rules, is the problem solved?
No. The rules are a symptom of account takeover. The attacker's access, any added MFA methods or app consents, and other mailboxes they may have reached all need to be addressed, or they will simply return.
How do we know what the attacker saw?
Microsoft 365 keeps audit and sign-in records that can show when the attacker was active and which messages were accessed, depending on your licensing and retention. We review what is available and summarize it in plain English.
Should we warn our clients?
If fraudulent payment requests may have reached them, a prompt heads-up through a trusted channel such as a phone call can prevent losses. We help you identify who was likely contacted.