Email forwarding rules: the silent way attackers steal your mail

After compromising an account, attackers often set up a quiet auto-forwarding rule sending copies of every email to an external address, so they keep reading your mail even after you change the password. Periodically check Outlook and Gmail rules and mailbox forwarding settings for anything you didn't set up yourself.

Coach's tip: many admin consoles let you block or alert on new external forwarding rules company-wide — turn that on, it's one of the highest-value settings available.