How Should a Small Business Manage Email Forwarding Rules?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Write down every automatic email forwarding rule in your business, who set it up, where it sends mail, and why. Review the list on a schedule and every time someone leaves. Hackers who break into an inbox often add a hidden forwarding rule so they can read your invoices and payment emails, so block forwarding to outside addresses unless you have a clear reason.

What this means

A forwarding rule automatically sends a copy of some or all incoming email to another address. Some are useful, like sending billing@ to your bookkeeper. Others are risky, like a rule that sends every email with the word “invoice” to an unknown outside address.

The outline asks you to document and review automatic forwarding.

Made-up example: The owner of Bayside Pet Grooming checks her mailbox rules during a quarterly review. She finds one sending all mail to an address she doesn’t know, created three weeks earlier. She deletes it, changes her password, turns on multi-factor authentication, and checks recent payment emails. Her provider’s setting now blocks forwarding to outside addresses for everyone.

Why it matters

Attackers use forwarding rules to hide. The Federal Bureau of Investigation (FBI) has warned that in business email compromise scams, criminals set up auto-forwarding rules after breaking into an inbox so they can watch messages without being noticed.
Rules can hide in places you don’t look. The FBI noted that rules made in web email may not show up in desktop email programs, so checking one place may miss them.
Old rules leak data. A rule set up for a former helper can keep sending customer emails to them for years.
Leads get lost. A rule that moves form alerts to a folder nobody checks means missed customers (see 13.2.8 Form Delivery).

Who this applies to

Every business that uses email. It matters most for anyone who handles payments, invoices, or customer data.

How to do it

Find all rules. Check each mailbox’s settings in the web version of your email, not only the desktop or phone app. Look for forwarding addresses, filters, and inbox rules.
Write them down in your access inventory: mailbox, rule, destination, who set it up, why, and the date (see 11.7.5 Access Inventory).
Delete what you don’t need.
Block outside forwarding at the admin level if your provider allows it. In Google Workspace, for example, an admin can turn off users’ ability to automatically forward email. The FBI recommends prohibiting automatic forwarding to external addresses.
Use shared inboxes instead of forwarding to personal addresses (see 12.1.2 Email Accounts and Shared Inboxes).
Turn on multi-factor authentication so a stolen password isn’t enough to add a rule (see 12.1.6 Email Security).
Review on a schedule, such as every quarter, and every time someone leaves (see 11.7.7 Removing Access When People Leave).
If you find a rule you didn’t make, treat it as an account takeover (see 11.9.2 Account Takeover).

What proof to keep

The forwarding rule list with dates and owners
Screenshots of the admin setting for outside forwarding
Review dates and who did the review

Common mistakes

Only checking the desktop app. Rules made in web email may not appear there.
Forwarding business mail to a personal Gmail for convenience.
Leaving a departed person’s forwarding on indefinitely. Set an end date.
Ignoring rules that move mail to folders. Attackers also use rules that hide replies in odd folders.
No admin block on outside forwarding.

When to get help from a pro

An email provider or information technology (IT) helper can check rules across all mailboxes at once and set admin controls. Questions to ask:

Can you list every forwarding rule across all our mailboxes?
Can we block automatic forwarding to outside addresses?
Can we get alerts when someone creates a new forwarding rule?

Bill’s note

[Bill: add a short note. For example, a forwarding rule you found in a client’s inbox that nobody remembered setting up, and what it was sending.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: checking each SiteSmarty mailbox, the rules list, and the outside forwarding setting]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the rules list and admin setting]
[Result so far:]

Questions people ask

Can hackers set up email forwarding? Yes. The FBI has warned that criminals add auto-forwarding rules after breaking into business inboxes.

Should I block forwarding to outside email addresses? For most small businesses, yes, unless there’s a clear, written reason for one.

How do I forward a former employee’s email? Send it to a manager’s business address or a shared inbox for a set time, then turn it off.

How often should I check forwarding rules? On a set schedule, like every quarter, and whenever someone leaves.

Audit check

Question: Is every automatic email forwarding rule written down, reviewed on a schedule, and is forwarding to outside addresses blocked or approved?
Pass looks like: A current rule list, outside forwarding blocked by default, reviews logged, and departures handled.
Fail looks like: Nobody knows what rules exist, mail forwarded to personal or unknown addresses.
Evidence to collect: The rule list, admin settings screenshot, and review log.

Where this fits

Do this first: 12.1.2 Email Accounts and Shared Inboxes

Do this next: 12.1.6 Email Security

Sources

Federal Bureau of Investigation, "Cyber Criminals Exploit Email Rule Vulnerability to Increase the Likelihood of Successful Business Email Compromise" (checked October 17, 2026)
Google Workspace Admin Help, "Let users automatically forward their own Gmail emails" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.