Five signs your business email account has been compromised
A hacked email account is often the start of invoice fraud or a data breach. Five signs to check for, and what to do if you find them.
Mark Whittley · 8 November 2026
Email account compromise was the most common cybercrime reported by Australian businesses in 2024–25, at 19% of business reports, according to the Australian Signals Directorate. Many of those accounts were used for fraud. Many more were caught before money moved.
Attackers try hard not to be noticed. But they almost always leave traces. Here are five to look for.
1. Mailbox rules you didn’t create
This is the most telling sign. Attackers create rules that forward copies of email elsewhere, or move replies into obscure folders so the real owner doesn’t see them. Check your rules and forwarding settings. Anything that moves, deletes or forwards mail and you don’t recognise is a red flag.
2. Sign-ins from places you’ve never been
Most business email platforms keep a record of sign-ins, including location and device. A sign-in from another country, or from a device type nobody uses, deserves an explanation.
3. MFA prompts nobody asked for
If someone is being asked to approve a sign-in they didn’t start, someone else has the password. Never approve an unexpected prompt.
4. Sent emails nobody wrote
Check the Sent and Deleted folders. Attackers often send phishing emails to your contacts, or reply to payment conversations, then delete the evidence.
5. Contacts asking about strange emails
Clients or suppliers asking “did you send this?” is often the first sign anyone notices. Take it seriously.
If you find something
- Change the password and sign out all sessions. Turn on multi-factor authentication if it isn’t already.
- Don’t delete the rules or emails yet. Note or screenshot them. They show what the attacker did.
- Check whether money has moved. If a payment went to new bank details, call your bank immediately.
- Warn your contacts by phone not to act on payment requests from your address.
Resetting the password stops the immediate problem. It doesn’t tell you what the attacker read, downloaded or sent while they were in. If the mailbox held client information, financial details or anything sensitive, that question matters for your clients, your insurer and possibly your notification obligations.
Flare can tell you how they got in, what they touched and whether they’re really gone. Call 1300 027 401, 24/7, or read about our account compromise investigations.