After a Gmail compromise, check both general forwarding and individual filters. Disabling one forwarding setting does not establish that no rule can still copy selected mail or hide security messages.
Secure access before cleaning up settings
Use a trusted device to change the password and review unfamiliar sessions and sign-in methods. If you cannot sign in, start Google’s official recovery process.
Keep a brief private record of unauthorized settings if needed, but stop active unauthorized access promptly. Do not leave a malicious rule running solely to gather more examples.
Inspect general forwarding
- On a computer, open the affected Gmail account.
- Select Settings → See all settings.
- Open Forwarding and POP/IMAP or Forwarding, as shown.
- Inspect any forwarding destination and whether forwarding is enabled.
- Disable forwarding you did not authorize and save the change.
Check the actual destination address. A reassuring display label is not sufficient. If the setting belongs to an organization workflow, involve the administrator when determining whether it is legitimate.
Inspect filters separately
Open Filters and Blocked Addresses. Review rules that forward, delete, or automatically archive messages, particularly rules matching security senders, financial messages, or password-reset mail.
Delete or correct unauthorized filters individually. A filter can affect only a narrow category, so an otherwise normal inbox is not proof that every rule is safe. Changing the general forwarding switch does not replace this inspection.
Check other ways mail can be accessed
Under Accounts and Import, inspect delegates and sending identities. Review linked apps and any relevant mail-client access. Do not assume that the absence of forwarding proves nobody else could read messages.
Send a harmless test after cleanup and revisit the saved settings. Review missing messages through Gmail’s normal folders and search rather than deleting or resetting the whole mailbox.
Understand what cleanup cannot reverse
Removing a rule stops that rule’s future operation; it does not recall messages already forwarded. Assess sensitive information that may have left the mailbox and secure dependent accounts as needed. For organization data, notify the administrator through the approved incident channel.
Official references
- Automatically forward Gmail messages to another account
- Create rules to filter your emails
- Gmail security tips
- Secure a hacked or compromised Google Account
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.