Inbox rule auto-forwards financial-keyword emails to external address

Ankit Mehta@Secvyn

•updated Sep 12, 2026•0•0•1

Detects the creation of an inbox rule in Microsoft 365 that includes common financial terms ('invoice', 'payment', 'wire', 'transfer') and utilizes email forwarding ('ForwardTo' or 'RedirectTo'). This pattern is highly indicative of Business Email Compromise (BEC) attempts, where an attacker intercepts financial correspondence.