The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Check both automatic forwarding and message rules or filters: they are separate settings, and turning off one does not clear the other. If you find an unfamiliar setting, remove it, then secure the account by changing its password and reviewing account access and recovery details. For a work or school mailbox, ask your email administrator to check for forwarding that is managed outside your visible inbox settings.
Where unauthorized forwarding can hide
Email can be sent elsewhere in more than one way. A mailbox-wide forwarding setting can send incoming messages to another address, while a rule or filter can forward only messages that match certain conditions. Rules may also conceal activity by deleting messages, moving them out of the inbox, or marking them as read. Microsoft describes these behaviors in its guidance on suspicious email forwarding activity.
| Control | What it can do | Where to look |
|---|---|---|
| Automatic forwarding | Send incoming mail to another address, potentially regardless of its contents. | The mailbox’s forwarding setting. |
| Rule or filter | Forward or redirect selected messages; it may also move, delete, or mark messages as read. | The inbox rules or filters list. |
| Administrator-managed forwarding | Set forwarding at the work or school mailbox level, outside a user’s ordinary inbox-rule controls. | Your organization’s Microsoft 365 administrator or email team. |
Google explicitly advises Gmail users to check both account-wide forwarding and filters that forward messages. Microsoft likewise treats inbox rules and mailbox forwarding as settings to investigate when an account is compromised. See Google’s Gmail security tips and Microsoft’s Microsoft 365 compromised-account guidance.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThat distinction matters when investigating an unfamiliar destination. If you turn off mailbox-wide forwarding but leave a filter that forwards selected messages, those matching messages may still be sent elsewhere. The reverse is also true: deleting a suspicious filter will not necessarily disable account-wide forwarding. Check each control separately, including any administrator-managed setting for a work or school mailbox.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rules can be suspicious even when they do not forward mail. For example, a rule that moves messages out of the inbox, deletes them, or marks them as read can make replies or security notices harder to notice. Review the full list of rules and filters, not just entries with the word “forward” in their name. The action attached to a rule is more informative than its label.
Before you remove a setting
If you did not enable forwarding, treat the change as a possible sign that someone accessed the account. Google’s Gmail guidance says that if a forwarding notice appears and you did not set it up, change your password immediately and turn forwarding off. Use a trusted device and a network you trust when signing in.
- Note the unfamiliar destination address, rule name, or change before removing it. This can help your provider or workplace administrator investigate.
- Do not click links in an unexpected security message. Open the mail provider’s site or app directly and sign in there.
- If you cannot change the setting, or it returns after removal, contact the provider or your organization’s IT team rather than repeatedly deleting it without checking account access.
Keep the note brief and factual: record what setting you found, where it appeared, and when you noticed it. Avoid forwarding suspicious messages to another personal address as a way to save them; that could disclose more information. For a work mailbox, report what you found through your organization’s security or IT process so the administrator can investigate using its procedures.
Do not assume an unfamiliar destination is harmless just because you do not see messages missing from the inbox. A rule may apply only to certain senders or message types, and a separate rule may conceal messages in another way. Check both the destination and the rule’s actions and conditions before deciding what to remove.
Gmail: check forwarding and filters
Use Gmail in a browser for the fullest inspection. The mobile app may not expose all relevant settings; Google directs users to the settings page to check forwarding and POP/IMAP.
- Open the full settings: In Gmail, select the gear icon, then See all settings.
- Check mailbox-wide forwarding: Open Forwarding and POP/IMAP. If forwarding is enabled to an address you do not recognize, turn it off and save the change. If you see a forwarding notice that you did not set up, Google says to change your password immediately as well. See Automatically forward Gmail messages to another account.
- Inspect filters: Open Filters and Blocked Addresses. Review filters for actions such as Forward it to, and edit or delete any you did not create. Also look for filters that delete or archive messages, since those can hide mail without forwarding it. Google explains filter setup and actions in Create rules to filter your emails.
- Check related access: Review Accounts and Import for unfamiliar Send mail as addresses, account delegation, or POP access. These are separate from forwarding and can provide other ways to send, read, or access mail.
When reviewing a filter, look at both what messages it matches and what it does to them. A filter can be limited to a particular sender or other message conditions, so it may not affect every email. If its action includes forwarding, remove or edit the filter if it was not yours. Also inspect filters that delete or archive mail: those actions can hide messages even though they do not send them to another address.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After changing the forwarding setting or filter, save the change where Gmail prompts you to do so. Then revisit both settings pages to confirm the unfamiliar forwarding and filter action are no longer present. This is not a substitute for account recovery: Google’s guidance says an unexpected forwarding notice should prompt an immediate password change as well as turning off forwarding.
Recommended Free Tools
Outlook.com and Outlook apps: check forwarding and rules
Outlook’s interface varies by product and version, so use the directions for the Outlook you actually have. Microsoft’s support page covers Outlook.com, Outlook on the web, New Outlook, and classic Outlook: Turn automatic forwarding on or off in Outlook.
- Check automatic forwarding: In supported versions, open Settings > Mail > Forwarding. Turn forwarding off if it points to an address you did not choose, then save the change if prompted.
- Check inbox rules: Open Mail > Rules in Outlook on the web or New Outlook. Look for rules that forward or redirect mail, as well as rules that delete, move, or mark messages as read. Remove rules you did not create.
- In classic Outlook, inspect the rules manager: Go to Rules > Manage Rules & Alerts, then examine rules that forward or redirect messages and other rules that could hide mail. Remove unfamiliar rules.
Do not treat these paths as interchangeable: the names and locations differ across Outlook.com, Outlook on the web, New Outlook, and classic Outlook. If you do not see the listed control, consult Microsoft’s support directions for the version you are using rather than assuming that forwarding is disabled. Check the forwarding setting and the rules list as separate tasks.
For each rule, look for forwarding or redirect actions and for actions that could hide a message, such as moving it, deleting it, or marking it as read. Remove only rules you do not recognize or did not create; if a work account is involved and a rule’s purpose is unclear, ask your organization’s administrator. The FBI’s joint advisory for Outlook users also recommends removing suspicious rules and verifying that forwarding is unchecked: A Practical Guide to Securing Your Outlook Account.
Microsoft 365 work or school mail: involve your administrator
A work or school mailbox can have both user-created inbox rules and mailbox-level forwarding managed by an administrator. If you do not find the cause in your visible Outlook forwarding and rule settings, or you cannot change the setting, contact your organization’s IT or email administrator. Microsoft’s compromised-account response guidance includes checking inbox rules with hidden rules included and removing suspicious mailbox forwarding. An administrator may also need to investigate the mailbox and revoke active sessions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not assume that a clean visible rules list proves that the mailbox has no forwarding. Microsoft notes that email forwarding can disclose information, and its response guidance covers controls beyond an ordinary user’s inbox view. The administrator can determine whether a tenant-level setting is involved and handle it using the organization’s procedures.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When you report the issue, share the unfamiliar address or rule details you recorded and explain which user-facing settings you already checked. Do not try to work around organization controls or make repeated changes if you lack permission. The administrator can distinguish user-created rules from mailbox-level forwarding, inspect hidden rules as part of the response, and decide whether additional administrative steps—such as revoking active sessions—are needed.
Forwarding at work can expose messages beyond the organization, so report it promptly even if you are unsure what was sent. Microsoft Learn describes the risk plainly: “Email forwarding can be useful, but can also pose a security risk due to the potential disclosure of information.” The organization’s administrator can assess the mailbox and follow its incident-response process.
Yahoo Mail: inspect filters and auto-forwarding
Yahoo’s compromised-account checklist recommends checking both mail filters and the auto-forwarding address. In Yahoo Mail settings, review the filters list and forwarding address; remove or correct changes you do not recognize. Yahoo’s page also recommends recovery steps such as changing the password, removing unrecognized app passwords, checking account recovery methods, restoring changed mail settings, and enabling two-step verification. See Recognize a hacked Yahoo Mail account.
As with other providers, inspect both controls rather than stopping after you find one. A suspicious filter may apply only to selected messages, while the auto-forwarding address is a separate mailbox-wide setting. If Yahoo’s settings or access controls differ from what you expect, use Yahoo’s compromised-account checklist and follow its recovery steps rather than relying on a single change to the forwarding address.
Secure the account after removing the rule
Removing forwarding stops that particular setting from sending messages; it does not establish that the account is secure. Follow your provider’s account-recovery guidance and review other ways someone might retain access.
- Change the password: Choose a new, unique password from a trusted device. If you reused the old password on other accounts, change those passwords too.
- Review recovery details: Confirm that recovery email addresses and phone numbers belong to you. Remove or correct unfamiliar details.
- Remove unauthorized access: Delete unknown app passwords or connected applications, check account delegation and other access options, and sign out sessions you do not recognize where the provider offers that control.
- Turn on stronger sign-in protection: Enable multi-factor authentication or two-step verification. Google’s compromised Google Account guidance and Yahoo’s checklist both include account-security recovery measures.
- Review recent mail activity: Check sent mail and account activity for actions you did not take. Recheck rules, filters, forwarding, and settings that move, delete, archive, or mark messages as read.
Work through these checks even if you have already removed the forwarding setting. A password change addresses the account credential, but recovery details, app passwords, connected access, or delegated access may also need review. Google’s Gmail security guidance calls out related mail settings such as “Send mail as,” delegation, POP access, and filters that delete messages; Yahoo’s checklist includes app passwords and recovery methods. The right checks vary by provider, so use that provider’s account-recovery guidance alongside the forwarding cleanup.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
For a Microsoft 365 work or school account, the administrator may need to investigate the mailbox and revoke active sessions as part of incident response. As a user, report the issue and provide the details you found; the administrator can take steps that are not available in your ordinary inbox settings. For a personal account, use the provider’s available account-activity and access controls to check for unfamiliar activity and remove access you do not recognize.
There is no prevalence figure in the official guidance cited here that would show how often malicious forwarding occurs. The important point is practical: forwarding can disclose information, and suspicious rules can also hide activity. Check the settings and secure the account based on what you find rather than assuming the incident is harmless or that one password change alone has resolved it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If forwarding returns or you cannot remove it
A setting that reappears can mean another access method or active session remains, or—on work mail—an administrator-managed control is involved. This is not a diagnosis that applies to every provider; it is a reason to recheck sign-in and recovery access and ask the provider or workplace administrator to investigate. For a Microsoft 365 organization, the administrator can use Microsoft’s compromised-account response guidance to investigate the mailbox and take administrative response steps.
If the account is used for work, report the incident promptly and follow your organization’s security process. Forwarded messages may expose sensitive information, so the administrator may need to assess what was accessible and whether other mailboxes or account settings require attention.
If you are using a personal account and the setting cannot be changed, use the provider’s compromised-account recovery guidance and contact its support channel. For an organization account, do not assume that repeatedly deleting a visible rule will fix an administrator-managed setting; ask IT to check mailbox-level forwarding and any hidden rules. If you can remove the setting, still complete the access and recovery review before treating the issue as resolved.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Frequently Asked Questions
Why is my email forwarding to an address I don’t recognize?
It may be enabled in a mailbox-wide forwarding setting, or a rule or filter may forward only messages that match certain conditions. Work or school mail can also have administrator-managed mailbox forwarding that is not visible as an ordinary inbox rule. Check each relevant control and treat an unfamiliar setting as a possible sign of account access you did not authorize.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
How do I stop someone from forwarding my emails?
Turn off unfamiliar automatic forwarding and remove or edit unfamiliar forwarding rules or filters; these are separate controls. Then change the account password from a trusted device, check recovery details and other access methods, and enable multi-factor or two-step verification. For work or school mail, contact the administrator if you cannot see or change the setting.
Can an attacker hide emails with a rule?
Yes. Microsoft describes suspicious rules that may delete or move messages, or mark them as read; a rule may also forward selected messages. Review the full rules or filters list for these actions, not only rules labeled as forwarding.
I removed the rule, but it came back. What should I do?
Recheck the account’s sign-in and recovery access, and review connected access, app passwords, or active sessions where those controls are available. A recurring setting may also be managed by an administrator on a work or school mailbox. Contact the provider or workplace administrator to investigate rather than repeatedly deleting the setting without checking access.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Is turning off forwarding enough to secure my account?
No. It removes that particular forwarding control, but does not establish that no other access method or hiding rule remains. Change the password, review recovery information and account access, check sent mail and activity, inspect rules and filters, and enable stronger sign-in protection.
The Bottom Line
Check both automatic forwarding and rules or filters, because either can send messages elsewhere and rules can also hide mail. Remove unfamiliar settings, then change the password and review recovery details and other account access. If a work or school mailbox has no explanation in its visible settings—or the setting returns—ask the administrator to investigate.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
