What Is Email Account Takeover and How Do You Prevent It?

Email account takeover is when an attacker gains access to a legitimate email account and operates it as their own. They can read messages, send fraudulent ones, and impersonate the real owner from inside a fully trusted inbox.

It is dangerous precisely because the email is real. There is no spoofing to detect and no fake domain to flag. The attacker is sending from the actual account.

How an account gets taken over

Attackers get in through a handful of common doors.

• Phishing. The owner enters their password into a fake login page.
• Reused passwords. A password leaked from another breach unlocks the email account too.
• Weak or missing two-factor authentication. Without a second factor, a password is all an attacker needs.
• Malware. Software on a device quietly captures credentials.

Once inside, attackers often lie low. They read mail, learn how the person communicates, and wait for the right moment to strike.

What attackers do once they are in

A compromised inbox is a launchpad for further fraud.

1. They study past emails to learn relationships, tone, and ongoing deals.
2. They set up hidden mailbox rules that auto-delete or hide replies so the owner stays unaware.
3. They send fraudulent requests, such as fake invoices or payment changes, to contacts who trust the account.
4. They reach into connected systems or reset passwords on other services using the inbox.

This is a powerful engine for business email compromise, because the fraudulent messages truly come from a real, trusted sender.

Warning signs your email account was taken over

Look for these clues, on your own account and on those of coworkers.

• Sent messages you did not write, or emails missing from where you expect them.
• New mailbox or forwarding rules you did not create, especially ones that delete or move replies.
• Login alerts from unfamiliar locations or devices.
• Contacts replying to messages you never sent.
• Password reset emails for other services that you did not request.
• Coworkers receiving odd requests that seem to come from you.

Any of these warrant an immediate check.

How to prevent email account takeover

Prevention is layered. No single control does everything.

Lock the front door.

• Turn on multi-factor authentication for every account. This is the single biggest protection.
• Use a password manager so every login is long and unique.
• Train your team to recognize fake login pages, the most common entry point.

Watch for trouble.

• Review account activity and forwarding rules regularly.
• Set alerts for new logins from unusual locations.
• Make sure people know how to report a suspected compromise quickly.

Stop the messages that lead to it. Most takeovers start with a phishing email that harvests a password. Many of those slip past basic filters, which is why spam filters miss targeted attacks.

CIVRA helps on both ends. It catches the targeted phishing that leads to a takeover, and because it analyzes sender behavior rather than just the address, it can flag a trusted account that suddenly starts acting out of character. It scans attachments, detects look-alike domains, and reads message intent, working alongside Microsoft 365 and Google Workspace through a Chrome extension and an Outlook add-in. See how on the features page.

What to do if an account is compromised

Move quickly and methodically.

1. Change the password immediately and turn on multi-factor authentication.
2. Remove unknown mailbox rules and forwarding settings the attacker added.
3. Sign out all active sessions to kick the attacker out.
4. Warn contacts who may have received fraudulent messages.
5. Check connected accounts for password resets or unauthorized access.
6. Review how the breach happened and tighten your defenses.

FAQ

How is account takeover different from email spoofing?

In spoofing, an attacker fakes a sender address from outside. In account takeover, the attacker controls the real account and sends from the genuine address, which makes the fraud far harder to detect.

What is the single best way to prevent email account takeover?

Multi-factor authentication. Even if an attacker steals a password, the second factor usually stops them from getting in. Pair it with unique passwords and phishing awareness.

Why are hidden mailbox rules a warning sign?

Attackers create rules that auto-delete or move incoming replies so the real owner never sees the responses to fraudulent emails. Finding a forwarding or delete rule you did not set is a strong sign of compromise.

Can email security tools detect a compromised account?

Yes, when they analyze behavior rather than just the sender address. A genuine account that suddenly sends unusual requests can be flagged based on how it is behaving, even though the address is legitimate.

Close the door on account takeover before it opens. Get started with CIVRA or compare plans on our pricing page.