After recovery, record the forwarding destination, filter criteria, actions, and dated screenshots before you remove the rule. An unauthorized forwarding rule is a Gmail setting or filter left by an intruder to copy new incoming mail elsewhere.
Deletion clears the visible evidence, while copies already sent stay outside your mailbox. A short pause to preserve details helps you check password resets, financial mail, and account activity. The record also helps confirm compromise and clean related access.
Table of Contents
- Where to look for the hidden rule
- What to save before you touch anything
- Why disable first instead of deleting
- What the rule alone cannot show
Where to look for the hidden rule
Google advises recovered users to check Settings > Forwarding and POP/IMAP for unknown addresses. It also advises checking Filters and Blocked Addresses for unauthorized "Forward it" or "Delete it" filters, as explained in Gmail security tips. Google says selective forwarding needs a verified address plus a filter with set criteria and the action "Forward it to" that address.
That is why you must record both the address screen and the filter screen. For example, a filter matching invoice or password reset can copy only sensitive mail. A paired action can delete or archive the original so you never see it.
What to save before you touch anything
Copy the exact destination, criteria, and actions before you click anything. Take screenshots that show dates, and save recent security and device activity, as CISA recommends in CISA eviction guidance.
Deletion removes the on-screen evidence, while forwarded copies remain outside the mailbox. Your saved record preserves what Gmail will no longer show after cleanup.
- Full destination address, including any external domain
- Filter name, matching criteria, and actions
- Dated screenshots of forwarding and filter pages
- Recent security events, devices, login time and location
- Subject lines and dates of exposed password-reset or financial messages
Why disable first instead of deleting
CISA advises responders to disable, not immediately delete, a suspect forwarding rule. The pause leaves time to review message history, login time, location, and devices to confirm compromise. Stay in the filter list and turn the suspect filter off.
Then search Sent, All Mail, Trash, and security activity for mail that matched its criteria. Look for logins from new places, unknown devices, and reset messages you did not request. Google reports stronger "Verify it's you" checks for creating, editing, or importing filters, adding a forwarding address, and enabling IMAP. Expect a 2-step check in a risky session, and do not re-enable forwarding until sign-in recovery is complete.
What the rule alone cannot show
Google states that a filter created to forward messages applies only to new incoming messages, as documented in filter rules help. Documenting the rule therefore does not reveal older mail already diverted or deleted. Google directs recovered users to review Gmail, Drive, Photos, location sharing, devices, and security events for unrecognized changes.
Check each area for new shares, delegates, connected apps, and forwarding-like alerts. CISA warns that cloud attackers use user-created forwarding rules and alerts for persistence and data collection. It urges routine review or restriction of forwarding, especially external auto-forwarding. Turn off unneeded external forwarding and recheck both settings pages after password and session cleanup.
You Might Also Like
- Cybersecurity: A Google Export Archive Was Leaked: How to Inventory the Services and Date Ranges Inside
- Cybersecurity for Google Data Exports: Why a Download Archive Can Be More Sensitive Than One Document
- Cybersecurity After a Google Account Appeal: How to Review Sessions You Do Not Recognize