← All guides
5 min read
Stopping silent external mail forwarding in Exchange Online and Gmail
Business Email Compromise (BEC) attackers hide inbox forwarding rules to exfiltrate invoices and password resets. Here is how to block them at the tenant level.
Why mailbox-level forwarding rules are so dangerous
Even after a compromised user resets their password, an attacker-created inbox rule or ForwardingSmtpAddress continues forwarding copies of every incoming invoice and contract to an external mailbox.
Block outbound automatic forwarding at the policy layer
Disable automatic external forwarding in your Exchange Online default outbound spam policy and uncheck user-configured automatic forwarding in Google Workspace Gmail End User Access.
PowerShellExchangeOnlineManagement · CIS M365 v3.1 2.1.1
Set-HostedOutboundSpamFilterPolicy -Identity Default -AutoForwardingMode Off