Summary: Changing the password blocks someone from signing in with the old password. However, they may still have an active session, a forwarding rule, access through a connected app, mailbox permissions, or a recovery method they added.
When someone gets into a business email account, changing the password should happen immediately. Once that is done, the account still needs a full check because other forms of access may remain.
During the time they had access, the attacker may have created a forwarding rule, approved a connected app, added a sign-in method, or granted access to another account. They may also have a browser or email app that is still signed in.
Email deserves particular care because it is connected to so many other services. Password-reset messages for accounting software, cloud storage, social media, and other business systems often arrive by email. Someone who can still read the inbox may be able to reach those accounts too.
That is why current recovery guidance from Microsoft, Google, and the UK National Cyber Security Centre includes several checks beyond changing the password.
Why a New Password May Not Remove Every Form of Access
Email services use sessions so you do not have to enter your password every time you open a message. After you sign in, the service gives your browser or email application a cookie or token that confirms the login has already been approved.
The service can continue accepting that session until it expires or is revoked. This means someone who signed in before the password changed may stay connected for a period of time, depending on the provider and the type of session.
The providers handle password changes differently. Google says that changing a password signs the user out in most places, but it lists exceptions that can include some devices and third-party applications. Google Workspace administrators also have separate controls for suspending an account and resetting its sign-in cookies.
Microsoft takes a similar approach for business accounts. Its guidance tells administrators to disable the affected account during the investigation and revoke active sessions separately.
The password change also leaves mailbox settings in place. A forwarding rule, delegate, or recovery method added while the account was compromised will remain until someone finds and removes it.
We've got your back
An Existing Session May Still Work
An active session is one of the first things your IT provider should check.
IMAGE SOURCE: https://www.pexels.com/photo/smartphone-screen-showing-account-verification-alert-33440144/
If the attacker signed in through a browser or email application, that session may still hold a valid token. Malware on an employee’s computer can also steal a session cookie and send it to someone else.
A stolen cookie may allow the attacker to use a session that has already passed the normal login checks. In that situation, they may not need to enter the new password.
The administrator should use the email provider’s tools to revoke the account’s active sessions and tokens. The exact name of the control varies between services. It may appear as “revoke sessions,” “reset sign-in cookies,” “sign out everywhere,” or “log out of all devices.”
If malware may be present on the employee’s computer, use another device to begin the recovery process. The affected computer should be checked before the employee signs in again.
Forwarding Rules Can Keep Sending Out Your Email
After closing the active sessions, check what was changed inside the mailbox.
An attacker can create a forwarding rule that sends a copy of every new email to another address. They may also use a filter that only forwards messages containing terms such as “invoice,” “payment,” “bank,” or “password reset.”
More selective rules are harder to notice because most email continues arriving normally. The attacker only receives the messages they are interested in.
Rules can also hide activity. For example, a rule may move security warnings, customer replies, or questions about a payment request into a folder the employee rarely checks.
Both Microsoft and Google tell users and administrators to check forwarding settings and mailbox rules after a suspected compromise.
Microsoft 365 administrators should perform this check through the administration tools, not only from the employee’s Outlook settings. Microsoft specifically recommends reviewing all inbox rules, including hidden ones.
A Connected App May Have Permission to Read the Mailbox
Forwarding rules are one way to keep receiving email. A connected application can provide another.
Image Source: https://www.pexels.com/photo/creative-photo-of-a-lock-key-16564254/
Businesses commonly connect email accounts to scheduling tools, customer management systems, mobile email apps, document services, and browser extensions. These connections often use OAuth.
When a user approves an OAuth request, the application receives permission to access certain parts of the account. The application does not need to store the user’s password.
Attackers can misuse this process by creating an application that looks genuine and asking the user to approve it. Microsoft explains that a harmful app consent grant can provide access to email, files, contacts, and forwarding rules.
Some app connections may stop after a password reset, while others need to be removed separately. Review every application connected to the account and remove anything the business does not recognize, use, or approve.
An application’s name and logo do not confirm who created it. Your administrator should check the company behind it and the exact permissions it received.
Someone Else May Have Mailbox Permissions
Business email platforms allow one person to access another person’s mailbox. An executive may give an assistant access, for example, or several employees may work through a shared mailbox.
This type of access is called delegation. A delegate signs in with their own account, so changing the mailbox owner’s password does not automatically remove the delegate.
Check every person and group with access to the mailbox. Confirm why they need it and remove any permission that the account owner or administrator cannot explain.
Sending permissions need attention too. Someone with “Send As” access may be able to send messages that appear to come directly from the mailbox, even if they cannot read its contents.
Check Recovery and Sign-In Methods
The attacker may have added a phone number, recovery email address, authenticator app, passkey, or security key while they controlled the account.
A recovery method could help them regain access later. An authentication method might also allow them to approve another sign-in without knowing the new password.
Microsoft tells administrators responding to a compromised mailbox to review the user’s registered MFA devices and remove anything suspicious. Google also advises users to check recovery details, recent security activity, devices, and sign-in methods.
Compare every entry with the account owner. Remove anything that neither the employee nor the administrator recognizes.
How to Secure a Compromised Email Account
Some of the settings involved are only visible through the business administration tools. Contact your IT provider or email administrator rather than asking the employee to handle the entire cleanup from their inbox.
Disable or Suspend the Account
The administrator may temporarily disable or suspend the account while checking it. They should also revoke active sessions and tokens so the attacker is signed out.
The employee may lose access for a short time, but leaving the account active gives the attacker more time to read, send, or delete email.
Change the Password
Set a password that has not been used for another account. If the employee reused the old password elsewhere, those accounts need new passwords as well.
Do not send the new password to the affected mailbox. Use a phone call, an approved password manager, or another method your business trusts.
Some older applications use separate app passwords. Microsoft’s current guidance notes that these are not automatically revoked when the main password changes, so your administrator should remove or replace them if they are present.
Review the Mailbox and Account Settings
Check forwarding addresses, inbox rules, filters, blocked addresses, delegates, sending permissions, signatures, automatic replies, and connected applications.
Then review the registered devices, phone numbers, recovery addresses, authenticator apps, passkeys, and security keys.
POP and IMAP access should also be checked. Some businesses still use these settings for approved email applications, so confirm how the account is used before disabling them.
Find Out What Happened
Once access has been removed, work out what the attacker did while they were inside.
Check the Sent, Deleted, Drafts, Junk, and Archive folders. Look for messages the employee did not write, replies they did not see, password-reset emails, and changes to payment instructions.
The administrator should review sign-in logs, audit records, email traces, and security alerts. Start the search before the first known warning because the original compromise may have happened earlier.
A login from an unfamiliar location does not prove that someone else used the account. Mobile networks, VPNs, and internet providers can affect location data. The device, time, IP address, application, and activity around the login provide more useful context when considered together.
Contact Anyone Who May Have Received a Fraudulent Message
If the account sent false messages, contact the recipients through a trusted channel. Tell them which messages were not genuine and whether they need to change a password, delete a file, or ignore a payment request.
Pay particular attention to messages involving bank details, invoices, payroll, gift cards, or password resets.
If money may have been sent to the wrong account, contact the bank or payment provider immediately. Use a phone number from its official website or your existing records rather than one found in the email conversation.
Secure the Account Before Returning It to the Employee
Once the unknown access, settings, and permissions have been removed, the administrator can return the account to the employee.
Require MFA before the employee signs in again. Where the email platform supports them, passkeys and physical security keys provide better protection against phishing than codes that can be entered into a fake login page.
MFA helps prevent another login with a stolen password. The earlier checks are still required because MFA does not remove existing forwarding rules, delegates, connected apps, or recovery methods.
How to Reduce the Risk of Another Compromise
Ask your IT provider to block automatic forwarding to outside addresses unless your business has a reason to allow it. Microsoft 365 and Google Workspace also provide controls for limiting which third-party applications employees can connect.
Require MFA for every email account, especially administrators and employees who handle payments or sensitive information. Use passkeys or physical security keys where the platform supports them.
Employees should report unexpected MFA prompts, unfamiliar login alerts, mailbox changes, and messages sent from their account that they do not recognize. Report these signs as soon as they appear so your IT provider can check the account before more email is sent or deleted.
Frequently Asked Questions
Does changing an email password sign out every device?
It depends on the provider. Some services sign users out of most sessions after a password change, while others provide separate controls for revoking sessions and tokens. Follow the account-compromise instructions for the email service your business uses.
Can someone still receive my email after I change the password?
Yes. A forwarding rule or filter may continue sending them copies of your messages. Check all forwarding settings and mailbox rules.
Can an app access my email without knowing my password?
Yes. An app may receive permission through OAuth, which allows it to access approved account data without storing the password. Review and remove any connected application the business does not recognize.
Should I delete a compromised email account?
The account is usually disabled or suspended while it is secured and investigated. Deleting it could remove information your IT provider needs to work out what happened.
Is MFA enough to secure the account?
No. Local administ MFA helps prevent new sign-ins, but it does not remove mailbox rules, app permissions, delegates, recovery methods, or active sessions that already exist. Those need to be checked separately.
Sources and Further Reading
- Microsoft: Respond to a compromised email account in Microsoft 365
- Microsoft: App consent grant investigation
- Google Workspace: Identify and secure compromised accounts
- Google: Gmail security tips
- UK National Cyber Security Centre: Hacked accounts
- Australian Cyber Security Centre: Review your email account security
If you think someone still has access to your business email, contact your IT provider immediately. If you do not have an IT provider, you can always reach out to us and we’ll help you.
—
This Article has been Republished with Permission from The Technology Press.
