Inbox rule abuse exposes BEC subculture and payment workflow gaps

At a glance

What this is: Coalition examines how BEC actors abuse inbox rules for concealment, coordination, and payment fraud reconnaissance.

Why it matters: It matters because email rule abuse can expose both identity compromise and finance-process weakness, which means IAM, SOC, and fraud teams need to treat mailbox controls as a security boundary.

Context

Business Email Compromise often begins with mailbox access and then shifts into inbox rule abuse, where attackers hide messages, redirect evidence, and preserve access long enough to monetize the account. In this article, the primary security problem is not just phishing or email filtering, but the way default mailbox features can become attacker infrastructure once an inbox is compromised.

The article also shows that BEC is not always a single-actor problem. When multiple intruders encounter the same mailbox, their rule names can become a coordination layer, which makes mailbox governance relevant to both fraud prevention and incident response. That is a control problem across identity, email administration, and payment workflow design.

Key questions

Q: What breaks when inbox rules are left unmanaged in BEC attacks?

A: Unmanaged inbox rules let attackers hide payment messages, suppress security alerts, and maintain persistence after initial mailbox compromise. The result is not just email clutter but a covert layer of control over who sees invoices, approvals, and warnings. That can turn a single mailbox into an operational asset for fraud.

Q: Why do inbox rule changes increase fraud risk so quickly?

A: Rule changes matter because they sit inside the same account that employees use for payment decisions, vendor contact, and escalation. When an attacker can reroute or suppress those messages, the fraud path becomes quieter and faster. The danger is greatest when the mailbox also drives financial approvals or executive communications.

Q: How can security teams detect mailbox-rule abuse early?

A: Watch for new rules that forward externally, delete messages, or route mail into obscure folders, especially when they appear within minutes of account compromise. Correlate those changes with risky sign-ins, OAuth consent events, and unusual user agents. Early detection depends on linking mailbox behaviour to identity telemetry.

Q: Who should own inbox rule governance in a BEC programme?

A: Ownership should be shared across messaging administration, identity security, and fraud or finance operations. Email teams control the platform, identity teams control the compromised account response, and finance teams understand which workflow changes indicate transfer risk. That shared model reduces the chance that suspicious rule activity is treated as only an email problem.

Technical breakdown

How inbox rules become attacker persistence

Inbox rules are a post-compromise control plane inside many email systems. Once an attacker has mailbox access, they can create rules that move payment requests, alerts, or suspicious messages away from the user’s primary view, often into folders that are rarely checked. That creates persistence without needing to stay visibly authenticated all the time. In BEC, this also supports reconnaissance because attackers can watch what gets routed, what gets missed, and which messages trigger workflow responses. The abuse is operationally simple, but the security impact is substantial because the mailbox becomes both a hiding place and a monitoring point.

Practical implication: Treat rule creation, especially for payment keywords and forwarding actions, as a high-risk mailbox event that should trigger immediate review.

Why inbox rules can reveal BEC tradecraft

The article’s unusual finding is that rule names themselves can carry attacker communication. That works because inbox rules are visible to anyone with sufficient mailbox access and can be edited repeatedly without attracting the same attention as outbound email. In practice, this exposes language, coordination habits, and local workflow knowledge. The attackers’ discussion of approval paths shows that mailbox compromise often becomes process compromise, where the real target is not just the mailbox but the payment decision path behind it. This is why BEC analysis needs to include both identity telemetry and finance process telemetry.

Practical implication: Correlate mailbox-rule telemetry with payment approval logic so investigators can distinguish simple concealment from coordinated fraud operations.

What secure-by-default email governance should block

The strongest defensive point in the article is that many organizations still allow attackers to use built-in mail features as stealth tooling. Secure-by-default governance means reducing the attacker’s available surface, not assuming users will notice subtle mailbox changes. If a rule can silently forward, suppress, or reroute invoice traffic, then it belongs in a high-friction approval path, not a user convenience layer. The same applies to external forwarding and rarely used folders such as RSS-style destinations. This is not a niche email-admin issue. It is a trust boundary for BEC containment.

Practical implication: Move risky mailbox actions into explicit approval, alerting, or blocking policies instead of relying on user vigilance.

Threat narrative

Attacker objective: The attacker wants to preserve covert access to the mailbox long enough to intercept communications, learn payment workflows, and execute or support fraudulent transfers.

1. Entry occurs when a threat actor compromises a mailbox and gains the ability to create or edit inbox rules without immediate notice.
2. Credential or account access is then used to hide payment-related mail, suppress warnings, and maintain a quiet presence inside the inbox.
3. Escalation happens when the attacker studies approval workflows and uses that knowledge to target invoice and transfer paths more precisely.
4. Impact is financial fraud or broader BEC coordination, sometimes amplified when multiple intruders compete or collaborate inside the same mailbox.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.
• TruffleNet stolen AWS keys campaign 2025: TruffleNet used 800+ attacker hosts to test stolen AWS keys and check SES capacity; one compromised account sent a fake $50,000 invoice.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Inbox rule abuse is a control-plane problem, not a cosmetic email issue. Once an attacker can manipulate rules, the mailbox stops being a communications tool and becomes a covert workflow engine. That shifts the security boundary from message content to mailbox behaviour, which is where many default configurations remain too permissive. The practical conclusion is that email governance must treat rule creation as privileged activity, especially where payment or executive communications are involved.

BEC is increasingly a process intelligence problem. The article shows that attackers study approval paths, payment rails, and user habits before acting, which means inbox compromise often exposes business logic as much as it exposes messages. That is a reminder that identity controls alone cannot contain BEC if finance workflows remain open to silent rerouting. Practitioners should view payment approvals as part of the identity attack surface.

Secure-by-default mailbox policy is now fraud infrastructure. If users can silently forward mail, route alerts away from the inbox, or hide traffic in rarely monitored folders, then the platform is helping the attacker preserve stealth. The governance failure is allowing convenience features to outrank containment. Teams should align mail platform defaults with fraud risk, not user preference.

Mailbox-rule telemetry should feed both IAM and SOC workflows. A sudden rule that references wires, invoices, or external forwarding is not just an email event. It is often evidence of active account misuse and potential payment fraud. The organisation that can correlate mailbox changes with sign-in, consent, and finance activity will usually detect BEC earlier than the organisation that treats them as separate domains.

From our research library:

• Businesses report a 200% surge in attempted deepfake-aided wire fraud in Q1 2025 alone.

What this signals

Mailbox-rule abuse should be treated as a fraud control issue as much as an email security issue. The article shows that attackers exploit the normal behaviour of mail systems to create stealth, and that means organisations need to move high-risk rule actions out of the user convenience layer. For practitioners, the key shift is to treat forwarding and keyword-based routing as governance decisions, not mailbox preferences.

BEC subculture exposes a wider identity and workflow weakness. The attackers’ conversations reveal that compromise often succeeds because they understand payment approval paths better than defenders assume. That means the real programme risk is not only mailbox access but the organisation’s tolerance for hidden process manipulation after access has been obtained.

Inbox rule telemetry can sharpen identity threat detection. Correlating rule creation with sign-in anomalies, payment approvals, and external forwarding gives defenders a better chance of catching active BEC before money leaves the organisation. The practical implication is to build mailbox behaviour into ITDR and fraud monitoring rather than leaving it in a separate email admin queue.

For practitioners

• Block high-risk inbox rule actions by default Prevent silent auto-forwarding, hidden routing, and payment-related filtering unless an administrator explicitly approves the mailbox rule.
• Alert on suspicious rule names and keywords Trigger high-severity review when a new rule contains sentence-length text, nonsensical phrasing, or terms such as wire, ACH, invoice, or confidential.
• Correlate mailbox changes with finance approvals Join rule-creation telemetry with payment workflow logs so investigators can see whether a new mailbox rule aligns with wire or invoice processing.
• Restrict rarely used mailbox destinations Disable or tightly control routing to folders that users rarely inspect, especially RSS-style or conversation-history locations that attackers can abuse for concealment.
• Reset credentials after confirmed mailbox misuse When mailbox-rule abuse is confirmed, revoke the session, reset the account credentials, and remove any persistence paths before the attacker can re-enter.

Key takeaways

• Inbox rule abuse turns a compromised mailbox into a stealth layer for BEC, allowing attackers to hide communications and support fraud.
• The article shows that attackers also use rule names to coordinate with each other, which exposes tradecraft and workflow awareness.
• Defenders should block risky mailbox actions by default and connect mailbox-rule telemetry to identity and finance monitoring.

Key terms

• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Inbox Rule Abuse: The misuse of email filtering rules to hide, redirect, or suppress messages after an account has been accessed. In Exchange, these rules can become persistence and exfiltration mechanisms when they are created inside a legitimate mailbox context and are not monitored for malicious action patterns.
• Mailbox Rule Persistence: Mailbox rule persistence occurs when an attacker creates forwarding, deletion, or filtering rules that keep control of a compromised inbox after the initial login. These rules can hide evidence, redirect messages, and preserve access even when the password is changed.
• Payment Workflow Reconnaissance: Payment workflow reconnaissance is the process of learning how an organisation approves wires, invoices, or other transactions so fraud can be timed and tailored. In BEC cases, mailbox access gives attackers a way to study those approvals from inside the normal communication stream.

Deepen your knowledge

NHI Mgmt Group's NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, and identity lifecycle control. It helps security and identity teams connect mailbox abuse, privilege, and response into one operating model.