Inbox rule abuse in BEC: what controls are teams missing?

TL;DR: Business Email Compromise actors use inbox rules not only to hide mail and maintain persistence, but sometimes to communicate with rival intruders, revealing workflow awareness, operational coordination, and payment-path reconnaissance that make mailbox abuse more than simple filtering evasion, according to Coalition's analysis. The control gap is broader than email hygiene: secure-by-default rule restrictions, forwarding limits, and faster detection are now part of fraud containment.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Inbox In-Fighting: A Window Into BEC Subculture”.

Key questions

Q: What breaks when inbox rules are left unmanaged in BEC attacks?

A: Unmanaged inbox rules let attackers hide payment messages, suppress security alerts, and maintain persistence after initial mailbox compromise.

Q: Why do inbox rule changes increase fraud risk so quickly?

A: Rule changes matter because they sit inside the same account that employees use for payment decisions, vendor contact, and escalation.

Q: How can security teams detect mailbox-rule abuse early?

A: Watch for new rules that forward externally, delete messages, or route mail into obscure folders, especially when they appear within minutes of account compromise.

Practitioner guidance

• Block high-risk inbox rule actions by default Prevent silent auto-forwarding, hidden routing, and payment-related filtering unless an administrator explicitly approves the mailbox rule.
• Alert on suspicious rule names and keywords Trigger high-severity review when a new rule contains sentence-length text, nonsensical phrasing, or terms such as wire, ACH, invoice, or confidential.
• Correlate mailbox changes with finance approvals Join rule-creation telemetry with payment workflow logs so investigators can see whether a new mailbox rule aligns with wire or invoice processing.

Bottom line: Inbox rule abuse turns a compromised mailbox into a stealth layer for BEC, allowing attackers to hide communications and support fraud.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →