Quick Answer: Someone can read your Outlook email without you knowing in four main ways: a rule that forwards or copies your mail to them, an active sign-in on a device that isn't yours, mailbox permissions given to another account, or an app that was granted access to your mailbox. None of these change how Outlook looks to you, but each one leaves a trace you can check.
If you find one and aren't sure what to do next, BridgeNet's cybersecurity team can help.
How can someone read your email without you noticing?
It feels like it should be obvious. If someone were in your inbox, you'd see emails marked as read, or something moved.
Usually, you don't.
Most mailbox snooping is set up to stay invisible. The attacker isn't sitting in your inbox clicking around. They've arranged for your email to come to them, or they read it from somewhere you'll never see.
Here are the four ways it happens, and how to check each one.
Is your email being forwarded somewhere?
This is the most common method, and the easiest one to check.
There are two ways forwarding gets set up:
- Mailbox forwarding, which sends a copy of every incoming email to another address
- Inbox rules, which can forward only certain messages, like anything containing "invoice," "wire," or "payment"
Rules are sneakier. An attacker might create one that forwards payment emails, then marks the original as read and moves it to a folder you never open.
How to check in Outlook on the web: go to Settings, then Mail. Look at Forwarding, then look at Rules.
How to check in the classic Outlook desktop app: go to File, then Manage Rules & Alerts.
Look for any rule you don't remember creating, especially one with a blank or one-character name. Look for any outside address you don't recognize.
How do you check for suspicious sign-ins?
Your Microsoft account keeps a record of recent sign-ins.
Go to mysignins.microsoft.com and open the Recent activity section. It shows when and where your account was used, along with the device and browser.
Things worth questioning:
- Sign-ins from a city, state, or country you weren't in
- Sign-ins at hours you weren't working
- Several sign-ins close together from different places
While you're there, open Security info. This shows the phone numbers and authenticator apps that can approve sign-ins to your account. If there's one there you didn't add, someone else can approve their own sign-ins as you.
Your IT team or Microsoft 365 admin can see more detail than you can, including risky sign-in alerts and the full audit trail.
Could someone inside your company have access?
Sometimes the access is legitimate, but forgotten.
Microsoft 365 lets one person be given access to another person's mailbox. It's common for an assistant who manages a calendar, or a manager covering during a vacation.
The problem is that those permissions often stay in place long after they're needed. A former assistant, a temp from last year, or an old shared account may still have access.
This isn't usually malicious. But every account with access to your mailbox is another account that could be compromised. Asking your admin for a list of who has permissions on your mailbox is a fair, routine request.
Can an app read your email?
Yes, if you or someone else gave it permission.
Some phishing attacks don't ask for your password at all. Instead, they show a real Microsoft screen asking you to grant an app access to "read your mail" or "maintain access to data you have given it access to." Clicking Accept gives that app ongoing access.
Because you approved it, there's no suspicious sign-in to spot, and changing your password doesn't remove it.
Your Microsoft 365 admin can review which apps have access to mailboxes in your organization and remove anything that shouldn't be there. They can also require admin approval before anyone grants a new app access, which closes this door for good.
What should you do if you find something?
Don't just delete the rule and move on. Whatever created it may still have access.
- Change your password from a device you trust.
- Tell your IT provider right away so they can sign out all sessions and review the account.
- Remove the forwarding, rule, or unknown security info, ideally after your IT team has documented it.
- Think about what was exposed. If invoices or payment details were in the forwarded mail, warn your accounting team and key vendors by phone.
Finding something is unsettling, but it's far better than not finding it.
Not sure who can see your company's email? BridgeNet's team will review forwarding, mailbox permissions, sign-in alerts, and connected apps across your Microsoft 365 accounts and explain what we find in plain English. Call 985-635-4380 or schedule a free cybersecurity assessment.
