How Hackers Keep Access to Your Email After You Change the Password

A password change is only the first move

Changing the password blocks sign-ins that still rely on the old password. It does not necessarily remove an active browser session, a forwarding rule, a connected application, mailbox delegation, or a recovery method added while the attacker was inside.

Email needs special care because it is connected to password resets for accounting, storage, social media, and other business systems. Someone who can still read the inbox may be able to reach those accounts too.

An existing session may still work

Email services use sessions so your browser and apps do not ask for the password every time. A session or token can remain valid until it expires or is revoked separately.

Ask your administrator to use the provider’s controls to revoke sessions, reset sign-in cookies, sign out everywhere, or remove active tokens. If malware may be present, begin recovery from another device.

Forwarding rules can keep sending copies

An attacker can create a rule that forwards every new message—or only messages containing words such as invoice, payment, bank, or password reset. Selective rules are harder to notice because most email continues arriving normally.

Check forwarding addresses, inbox rules, filters, hidden rules, and folders that may be hiding warnings or replies. Review these settings through the business administration tools, not only the employee’s inbox.

A connected app may still have permission

OAuth apps can access approved parts of an account without storing the password. A convincing fake app may receive permission to read mail, files, contacts, or forwarding settings.

Review every connected application. Remove anything the business does not recognize, use, or approve, and check the organization behind the app and the exact permissions it received.

Delegates and sending permissions are separate

A delegate may access a mailbox with their own account, so changing the mailbox owner’s password does not automatically remove that access. Send As or Send on Behalf permissions also need review.

List every person and group with access, confirm why they need it, and remove anything nobody can explain.

Check recovery and sign-in methods

An attacker may add a phone number, recovery email, authenticator app, passkey, or security key. These methods could help them return later or approve another sign-in.

Compare registered devices, recovery details, MFA methods, passkeys, and security keys with the account owner. Remove anything unfamiliar before returning the account.

Secure the account in the right order

Temporarily suspend or disable the account while sessions and tokens are revoked. Set a unique password through a trusted channel, then review mailbox settings, app access, delegates, devices, and recovery methods.

Do not send the new password to the affected mailbox. Remove older app passwords, inspect POP and IMAP access where relevant, and require MFA before the employee signs in again.

Find out what happened

Review Sent, Deleted, Drafts, Junk, and Archive folders for messages the employee did not write, payment changes, password resets, or replies they never saw. Check sign-in logs, audit records, email traces, and security alerts.

If fraudulent messages were sent, contact recipients through a trusted channel. For payment changes, contact the bank or payment provider immediately using an official number.

Reduce the chance of another compromise

Require MFA for every account, prefer passkeys or security keys where available, limit automatic external forwarding, and control which third-party apps employees can connect.

Treat unexpected MFA prompts, unfamiliar sign-in alerts, mailbox changes, and messages sent without the user’s knowledge as incidents worth reporting immediately.