Why Changing Your Email Password Isn't Always Enough

Changing the password on a compromised email account is the right first step. The problem is that it may not be the last one that matters.

Email services are designed so you do not have to log in every single time you open a message. When you sign in, the service issues your browser or email application a token - a kind of digital proof that you have already authenticated. That token stays valid until it expires or is deliberately cancelled. If an attacker signed in before you changed the password, their session may still be active unless someone specifically revokes it.

That is one of several ways someone can keep reading your email after the password has been reset. The others involve settings that were changed while the account was under their control, and that a password change leaves completely untouched.

Active sessions

Revoking active sessions is usually the first thing your IT support should do after a password reset. Both Microsoft and Google provide administrator controls for this - the label varies depending on the platform but it may appear as "revoke sessions", "reset sign-in cookies", or "sign out everywhere". This is distinct from changing the password and needs to be done separately.

There is an additional complication if the employee's device has malware on it. Some malware is designed specifically to steal session tokens and send them to a third party. A stolen token can be used to impersonate an already-authenticated session, which means the attacker may not need the new password at all. If there is any reason to suspect the device is compromised, use a different computer to begin the recovery process, and check whether the affected device may have malware before the employee signs back in on it.

Forwarding rules

An attacker who had time inside the account may have created a mail forwarding rule that sends copies of incoming messages to an address they control. Some of these rules are broad - forwarding everything - while others are more selective, forwarding only messages containing words like "invoice", "payment", "bank", or "password reset". Selective rules are harder to notice because most email continues arriving normally.

Rules can also be used to hide activity. A rule might move security alerts or customer queries to a folder the account owner rarely checks, so they do not notice unusual messages about their account.

Microsoft specifically recommends checking for hidden inbox rules through the administration tools, not just from the employee's Outlook settings. Some rules are only visible at the administrator level.

Connected apps

Businesses routinely connect email accounts to scheduling tools, customer management systems, mobile apps, and document services. Many of these connections use a protocol called OAuth, which allows an application to access parts of your account without needing to store your password. The access can survive a password change because the permission was granted to the application directly.

Attackers have used this by creating applications that appear legitimate and persuading users to approve an access request. Microsoft has documented cases where this type of app consent grant has been used to access email, files, contacts, and even forwarding rules. The application's name and logo are not reliable guides to who actually created it or what permissions it really has.

Every connected application should be reviewed after a suspected compromise. Remove anything the business did not deliberately set up, does not currently use, or cannot account for.

Mailbox delegates and sending permissions

Email platforms allow one person to access another person's mailbox. A practice manager might have access to a director's inbox, or several staff might share access to a central mailbox. This kind of access is called delegation, and a delegate signs in with their own credentials - so changing the mailbox owner's password has no effect on delegate access.

Microsoft 365 supports Full Access, Send As, and Send on Behalf permissions. Gmail supports delegated access too. Any of these could have been added while the account was compromised. Someone with Send As permission can send messages that appear to come directly from the mailbox, even without the ability to read its contents.

Check every person and group with access to the mailbox. If the account owner or administrator cannot explain why a permission exists, remove it.

Recovery methods and authentication settings

While they had access, the attacker may have added a recovery email address, phone number, authenticator app, or security key to the account. A recovery method added under their control could allow them to request a password reset later. An authentication method could allow them to approve a new login without knowing the current password.

Microsoft's guidance for compromised accounts specifically includes reviewing every registered MFA device and removing anything unrecognised. Google advises checking recovery details, recent security activity, and sign-in methods. Go through each entry with the account owner and remove anything neither of them added.

What a proper recovery looks like

Some of these settings are only visible through the business administration tools, not from the employee's own inbox. The employee should not be expected to handle this cleanup themselves.

The sequence that Microsoft and Google both recommend starts with disabling or suspending the account and revoking active sessions, before the investigation continues. This limits any further access while the checks are being made. The password should be changed using a method that does not involve sending it to the affected mailbox - a phone call, an approved password manager your business relies on, or a separate trusted channel.

Older applications sometimes use separate app passwords, and Microsoft notes these are not automatically revoked when the main account password changes. If any are present, an administrator needs to remove or replace them.

Once the access has been secured, the audit work begins. Check the Sent, Deleted, Drafts, Junk, and Archive folders for messages the employee did not write or replies they did not see. Review sign-in logs and email traces - and start the search earlier than the first known warning, because the original access may have happened before anything was noticed. A login from an unfamiliar location is worth investigating, but location data can be affected by VPNs and mobile networks, so the device, timing, IP address, and surrounding activity together give a clearer picture than location alone.

If the account was used to send false messages - anything involving invoices, payment details, bank accounts, or password resets - contact the recipients through a separate, trusted channel. If money may have moved to the wrong account, contact your bank immediately using a number from its official website or your existing records, not anything found in the email thread.

Before returning the account

Once the unknown access and settings have been removed, the account can be returned to the employee - but require MFA before they sign back in. Where the platform supports them, passkeys and physical security keys offer stronger protection than one-time codes, because codes can be entered into a convincing fake login page, while passkeys are bound to the genuine site.

MFA prevents an attacker from getting back in with a stolen password, but it does not remove any forwarding rules, app permissions, delegates, or recovery methods that were already there. Those need the separate checks described above.

To reduce the risk going forward, ask your IT support to block automatic forwarding to external addresses unless there is a specific business reason for it. Both Microsoft 365 and Google Workspace provide controls for limiting which third-party applications employees can connect to their accounts. Any unexpected MFA prompt, login alert, or message sent from an account that the employee did not send is worth reporting immediately - the earlier it is caught, the less damage there is to undo. If you want a broader view of how your practice is protected, our cybersecurity services for professional practices cover the controls that sit around your accounts, not just inside them.

For current guidance on responding to a compromised account, the NCSC NZ publishes advice at ncsc.govt.nz. Privacy breaches involving client information may also need to be reported to the Office of the Privacy Commissioner under the NZ Privacy Act 2020.

If you think someone still has access to a business email account, the account should be suspended and investigated before the employee continues using it. ITstuffed supports healthcare and professional services practices across Canterbury with this kind of response work. If you would like a 15-minute conversation about your email security, book an IT Fit Check.