A Password Change Isn’t Enough After an Email Account Is Compromised
If someone gets into a business email account, changing the password should happen immediately. But that should not be the only step.
While they had access, an attacker may have created forwarding rules, approved a connected app, added a new sign-in or recovery method, granted mailbox permissions, or left an active browser or email session behind.
Email requires particular care because it connects to so many other business systems. Password-reset messages for accounting software, cloud storage, social media, and other services often arrive by email. If an attacker can still access the inbox, they may be able to reach those accounts too.
That’s why recovery guidance from Microsoft, Google, and the UK National Cyber Security Centre includes additional steps beyond changing the password.
Why a New Password May Not Remove Every Form of Access
Email services use sessions so users do not have to enter their password every time they check their inbox. After signing in, the browser or email application may receive a token or cookie that keeps the session active.
Depending on the provider and type of session, an attacker who signed in before the password was changed may remain connected.
Google says changing a password signs users out in most places, although some devices and third-party applications may be exceptions. Microsoft also recommends that administrators revoke active sessions when responding to a compromised business account.
Changing the password also does not automatically remove mailbox rules, delegates, recovery methods, or connected apps that were added while the attacker had access.
Check Active Sessions and Devices
Your IT provider should review and revoke active sessions and tokens using the email provider’s administration tools. Depending on the service, the option may be called “revoke sessions,” “reset sign-in cookies,” “sign out everywhere,” or something similar.
If malware may be present on the employee’s computer, begin the recovery process from another trusted device and have the affected computer checked before signing in again.
Look for Forwarding Rules
An attacker may create a rule that forwards email to another address. They can also make selective rules that only forward messages containing terms such as “invoice,” “payment,” “bank,” or “password reset.”
Other rules may hide security alerts, customer replies, or responses to fraudulent payment requests.
Check all forwarding settings, filters, and inbox rules. Microsoft 365 administrators should also review rules through the administration tools, including hidden rules.
Review Connected Apps and Mailbox Permissions
Businesses often connect email accounts to scheduling tools, CRM systems, mobile apps, document services, and other applications using OAuth. These connections can give apps access without requiring the user’s password.
Microsoft notes that malicious app consent can provide access to email, files, contacts, and forwarding rules. Review connected applications and remove anything the business does not recognize or approve.
Mailbox delegation should also be checked. Someone with delegated access signs in using their own account, so changing the mailbox owner’s password does not remove their permissions.
Microsoft Exchange Online supports permissions such as Full Access, Send As, and Send on Behalf. Review everyone who can access or send from the mailbox and remove unexplained permissions.
Check Recovery and Sign-In Methods
An attacker may have added a phone number, recovery email address, authenticator app, passkey, or security key.
Compare every registered method with the account owner and remove anything that is not recognized. Also review recent devices and security activity for anything suspicious.
How to Secure a Compromised Email Account
Some of these settings are only available through business administration tools, so involve your IT provider or email administrator rather than relying on the employee to clean up the account alone.
1. Disable the Account and Revoke Sessions
Temporarily disable or suspend the account if appropriate, then revoke active sessions and tokens to remove existing access.
2. Change the Password
Create a new password that is not used anywhere else. If the employee reused the old password on other accounts, change those passwords too.
Do not send the new password to the compromised mailbox. Use another trusted method to provide it.
3. Review Account Settings
Check:
- Forwarding addresses and inbox rules
- Filters and blocked addresses
- Delegates and sending permissions
- Connected applications
- Signatures and automatic replies
- Registered devices
- Recovery email addresses and phone numbers
- Authenticator apps, passkeys, and security keys
- POP and IMAP access
Only remove settings after confirming they are not legitimately required for the business.
4. Investigate What Happened
Review Sent, Deleted, Drafts, Junk, and Archive folders for messages the employee did not create, password-reset emails, unusual replies, or changes to payment instructions.
Administrators should also review sign-in logs, audit records, email traces, and security alerts to understand what happened.
Do not rely on location alone when reviewing suspicious logins. VPNs, mobile networks, and internet providers can affect location information. Consider the device, IP address, application, time, and surrounding activity together.
5. Warn Anyone Who May Have Received a Fraudulent Message
If the account sent fraudulent messages, contact recipients using a trusted method and explain which messages were not genuine.
Pay particular attention to messages involving invoices, bank details, payroll, gift cards, or password resets.
If money may have been sent to the wrong account, contact the bank or payment provider immediately using contact information from its official website or your existing records.
6. Secure the Account Before Returning Access
Once unauthorized access and settings have been removed, require MFA before the employee signs back in.
Where supported, passkeys and physical security keys can provide stronger protection against phishing than codes that can be entered into a fake login page.
Remember, MFA helps prevent new unauthorized sign-ins, but it does not remove forwarding rules, delegates, connected apps, recovery methods, or existing sessions.
How to Reduce the Risk of Another Compromise
Ask your IT provider to:
- Require MFA for business email accounts.
- Consider passkeys or physical security keys where supported.
- Block external automatic forwarding unless the business needs it.
- Limit which third-party applications employees can connect.
- Train employees to report unexpected MFA prompts, unfamiliar login alerts, mailbox changes, or messages they did not send.
The sooner suspicious activity is reported, the sooner your IT provider can investigate and limit the damage.
Frequently Asked Questions
Does changing an email password sign out every device?
Not necessarily. This varies by provider, and some sessions or applications may require separate action to revoke access.
Can someone still receive my email after I change the password?
Yes. A forwarding rule or filter may continue sending copies of messages until it is removed.
Can an app access my email without knowing my password?
Yes. Apps using OAuth may have permission to access account data without storing the password. Review connected applications and remove anything unfamiliar.
Should I delete a compromised email account?
Usually, the account should be disabled or suspended while it is secured and investigated. Deleting it could remove information needed to determine what happened.
Is MFA enough to secure the account?
No. MFA can help prevent new unauthorized sign-ins, but existing sessions, forwarding rules, app permissions, delegates, and recovery methods still need to be reviewed.
Sources and Further Reading
If you think someone still has access to your business email, contact your IT provider immediately. If you don’t have one, reach out to Takala Technology and we’ll help you secure the account and determine what happened.
