Your business email may be compromised if customers receive messages you didn't send, you find inbox rules you didn't create, or sign-ins appear from places you've never been. Phishing affected 38% of UK businesses in the 2025/26 Cyber Security Breaches Survey, and a hacked mailbox is often used to send fake invoices with changed bank details.
Signs to check
- Sent items or deleted items you don't recognise
- Inbox rules that forward, move or delete messages, often with names like "." or "..."
- Replies from customers to emails you never sent
- Password reset emails you didn't ask for
- Sign-ins from unfamiliar countries in your Microsoft 365 or Google account activity
- Your outbound email suddenly blocked
What to do now
- Change the password from a device you trust and sign out all other sessions.
- Turn on multi-factor authentication.
- Remove unknown inbox rules, forwarding and connected apps.
- Warn customers and suppliers not to act on payment changes sent by email.
- Check other accounts that used the same password.
We can check your whole tenant and lock it down on a same-day Microsoft 365 call.
