How do I tell if someone is in our email?

A compromised mailbox does not look broken. The attacker wants it working normally, because they need to keep reading it. So the signs are small and easy to explain away, which is exactly why they usually get explained away.

The signs worth taking seriously:

• Emails you never saw. Somebody says they replied and you have no record of it. This is the big one, because the most common thing an intruder does is set a rule that files or deletes incoming mail about invoices and payments so you do not notice the conversation they are having in your name.
• Replies to messages you did not send, or contacts mentioning an email you do not remember writing.
• Items in your Sent folder you did not send, or conversely, a Sent folder that looks emptier than it should.
• Sign-in alerts or multi-factor prompts you did not trigger. If your phone asks you to approve a sign-in while you are sitting doing nothing, that is someone with your password trying to get in. Deny it and tell us the same day. Do not approve it to make it stop, which people do more often than you would think.
• Contacts telling you they got something odd from you, especially anything about payment or a shared file.
• Your password stopped working, or you were signed out unexpectedly.

Three checks you can run yourself right now:

• Look at your inbox rules. In Outlook, go to the settings for rules and read every one. You are looking for anything you did not create, particularly a rule that moves mail to a folder you never use, to Deleted Items, or to RSS Feeds. Rules with blank or single character names are a classic sign.
• Check forwarding. In the mail settings, look for forwarding to an outside address. Anything there you did not set up is serious and you should call us rather than just removing it.
• Check recent sign-in activity. Your Microsoft account shows where and when it has been signed into. Sign-ins from countries where none of your staff are, or from several places at once, are the clearest evidence there is.

If you find any of this, do not start deleting things. Call us first. The rule or the forward is evidence, it tells us what they were watching for, and removing it before we have looked costs us the ability to work out what they saw and whether anything was sent in your name.

For clients on a managed security agreement, we are watching for most of this already and you would usually hear from us before you noticed. The checks above are for anyone, including the business that does not have that in place yet.