Email Compromise Indicators: Confirming an Account Takeover

A compromised mailbox doesn't fail standard email authentication checks. It sends through real, authenticated infrastructure using a real, valid credential, so every check an email server performs passes. Confirming an email compromise means examining the account itself, not the domain's authentication configuration.

That distinction matters because investigations often start in the wrong place and miss the evidence a genuinely compromised account actually leaves behind. The indicators of email compromise that confirm an account takeover live inside the mailbox: its rules, its app permissions, and its sign-in history.

If any of the indicators below are already present in your environment, treat this as an active email compromise and move straight to containment: reset the credential, revoke active sessions, and lock down mailbox access before finishing the rest of this checklist.

Four Indicators of Email Compromise

Work through these four checks in order. Each one lives inside the mailbox itself since that is the only place a genuine email compromise leaves a trace.

Indicator 1: Mailbox Forwarding Rules

Attackers who gain access to a mailbox often set up a forwarding rule so they keep receiving copies of incoming email even after the account owner changes their password. This preserves visibility into invoice threads, password reset emails, and internal communications without requiring another login.

What to check:

Indicator 2: OAuth App Grants

Account compromise increasingly bypasses passwords entirely. An attacker who tricks a user into approving a malicious OAuth application gains a token that survives a password reset.

What to check:

Indicator 3: Anomalous Sign-In Activity

Sign-in logs capture the location, device, and time of every attempt, and they are one of the few places a compromised account leaves a consistent trace.

What to check:

Indicator 4: Mailbox and Delegate Changes

Attackers with access sometimes add themselves as a delegate on the account or exploit an existing delegate relationship, so they retain access even if the primary credential gets secured.

What to check:

What to Do When You Confirm Email Compromise

Any single indicator on its own might have an innocent explanation. Multiple indicators appearing together, especially a new OAuth grant combined with an unfamiliar sign-in and a hidden inbox rule, is a strong signal of an active email compromise.

At that point, move directly to containment: reset the credential, revoke all active sessions, remove the OAuth grant, and delete the malicious inbox rule, in that order, so the attacker loses access at every layer at once rather than one at a time.

How Sendmarc Can Help

The indicators above confirm an email compromise that has already happened. Sendmarc's Breach Detection intervenes earlier: it continuously monitors multiple sources, including the dark web, for employee credentials exposed in a data breach, and alerts your security team when a credential appears in a leaked dataset. That gives you the chance to reset the credential and review the account before an attacker acts on it.

For stretched security and IT teams, this removes a layer of manual investigation. Credential exposure gets flagged before it becomes an active email compromise, which cuts both the investigative workload and the window an attacker has to act.

Don't wait for the indicators above to show up before acting. Explore Breach Detection to get visibility into exposed employee credentials before they turn into an incident.