How to Check Gmail for a Hidden Forwarding Rule or Filter

To check Gmail for a hidden forwarding rule, look in three places in desktop Settings: the Forwarding and POP/IMAP tab, the Filters and Blocked Addresses tab, and the delegate list under Accounts and Import. A forwarding address or filter you didn't create is the rule. The rest of this guide shows what each one looks like and how to remove it.

Why it hides so well: someone who gets into a Gmail account rarely deletes your mail, because that would alert you. The quieter move is a forwarding rule that copies every incoming message to an address they control. You keep receiving mail normally, and so do they.

Gmail sends the verification link for a new forwarding address to that address — the attacker's own inbox — so nothing arrives in yours. The only cue on your side is a notice at the top of Gmail, "You are forwarding your email to [address]", which Google shows for the first week after forwarding is turned on. A second variant uses filters to archive or delete specific mail, such as security alerts and password-reset emails, so they disappear before you read them. It is the same filter builder you use to create rules in Gmail, pointed the wrong way.

Before you start#

You need Gmail in a desktop browser. The Gmail app on iPhone and Android doesn't show the Forwarding and POP/IMAP tab, the filter list, or delegate settings — Google says outright that you can't add delegates from the Gmail app — so this audit can't be done from a phone. On a phone with no computer nearby, open Gmail in the phone's browser and switch to the desktop version.

Sign in as the account you want to audit. Having delegate access to someone else's inbox doesn't let you audit their settings; they need to run these checks themselves, or a Workspace admin can check from the Admin console.

If something specific brought you here — a password-reset email you didn't request, a message someone mentioned that you never received, or the "You are forwarding your email" notice — start with the Forwarding and POP/IMAP tab. That is where the most common change appears.

How to check Gmail for a hidden forwarding rule#

Work through all three checks. Someone who added a forwarding address may also have created a filter, so a clean Forwarding tab doesn't rule out a filter problem, and the reverse is also true.

1. 1

   Open Gmail Settings in a desktop browser

   Click the gear icon in the top-right corner of Gmail and choose "See all settings." The quick-settings panel that opens first doesn't show the tabs you need.

2. 2

   Check the Forwarding and POP/IMAP tab

   Look at the Forwarding section at the top. "Disable forwarding" selected means account-wide forwarding is off. "Forward a copy of incoming mail to [address]" with an address you don't recognize is the rogue rule — note the address before you remove it. Also open the address drop-down even when forwarding is disabled: it lists every forwarding address that has been verified on the account, and a filter can only forward to a verified address. An unknown address in that list is a red flag on its own.

3. 3

   Check POP download on the same tab

   If you don't use POP in another mail app, the POP download status should read "POP is disabled." If POP is enabled and you never turned it on, another device may be downloading copies of your mail without any forwarding rule. IMAP no longer has a switch here — Google made it always on in January 2025 — so mail apps connected over IMAP show up under your devices and third-party connections instead.

4. 4

   Check the Filters and Blocked Addresses tab

   Read the action on the right of every filter. "Forward to [address]," "Delete it," and "Skip the Inbox (Archive it)" are the ones to scrutinize. Watch for broad matching criteria — every message, anything with an attachment, anything from your bank or from Google. A broad match combined with a delete or archive action is a strong sign of interference, and any filter forwarding to an address you don't recognize is suspicious whatever it matches.

5. 5

   Check delegate access in the Accounts and Import tab

   Scroll to "Grant access to your account." Every address listed there can read, send and delete mail in your account. Delegate access is separate from forwarding: a delegate can read your mail without any forwarding rule and never appears in the Forwarding tab. Remove any address you didn't add yourself.

After the three tabs, check which apps can reach your mail. Go to myaccount.google.com/connections and look for anything you don't remember approving. An app granted the "Read, compose, send, and permanently delete all your email from Gmail" permission, or one that can see and change your email settings and filters, can create forwarding filters without ever signing in as you. Revoke anything unfamiliar.

Where the settings live across Gmail and Google Workspace#

The navigation path is the same for personal Gmail and Google Workspace user accounts. What changes is what an admin can see from outside an individual account, and what an admin policy can restrict. Admin console paths are as of October 2026.

Workspace admins have one capability personal Gmail users lack: they can investigate across the whole domain without signing in as anyone. Gmail log events, under Reporting > Audit and investigation, show message traffic including whether mail went to an internal or external recipient, which can surface a mailbox quietly sending copies outside the company.

Admins can also stop the problem at the policy level. Under Apps > Google Workspace > Gmail > End User Access > Automatic forwarding, clear "Allow users to automatically forward incoming email", or keep it on and limit forwarding to internal addresses only. That blocks both users and anyone who compromises a user account from routing mail to a personal or attacker-controlled address. Check afterwards that existing forwarding has actually stopped.

What to do if you find a forwarding rule or filter you did not set up#

Finding something unexpected means someone had access to your account. Removing the rule stops the ongoing leak, but anyone with enough access to add a forwarding rule may have changed other things at the same time. Work through every step below before treating the account as clean.

1. 1

   Change your Google Account password first

   Go to myaccount.google.com > Security > Password and set a strong password you haven't used anywhere else. Do this before removing anything — otherwise whoever is in the account can simply put the rules back.

2. 2

   Remove the forwarding address

   In the Forwarding and POP/IMAP tab, select "Disable forwarding", then click Save Changes. To delete the address from the drop-down as well, choose the remove option for it in that list.

3. 3

   Delete malicious filters

   In the Filters and Blocked Addresses tab, click Delete next to any filter you didn't create. If you have many filters and aren't sure which are legitimate, tick them and click Export at the bottom of the page first — Gmail downloads an .xml copy you can keep as a record, or for your IT team.

4. 4

   Revoke delegate access

   In the Accounts and Import tab, remove any delegate address you didn't add.

5. 5

   Check recovery details, sessions and security events

   At myaccount.google.com > Security, confirm the recovery email and phone number are still yours — a swapped recovery address lets someone take the account back after you change the password. Then review "Your devices" and "Recent security activity" and sign out of anything you don't recognize. If an event wasn't you, open it and say so; Google then walks you through securing the account.

6. 6

   Revoke suspicious third-party app access

   At myaccount.google.com/connections, remove any app you don't recognize, especially one with Gmail access. Apps hold their own access tokens, so changing your password alone doesn't cut them off.

7. 7

   Turn on 2-Step Verification if it isn't already on

   Go to myaccount.google.com > Security > 2-Step Verification. A passkey, security key or authenticator app resists SIM-swap attacks better than SMS codes. For high-risk accounts, Google's Advanced Protection Program is the strongest option it offers.

A faster way to catch the attack before the forwarding rule appears#

This audit finds what is already in place. It can't stop the phishing email — usually a fake Google security alert or a login page spoofing your bank or IT team — that hands someone the password they need to add the rule in the first place.

That earlier step is where AI Emaily helps. Its spam protection scores every incoming message at sync: sender authentication (SPF, DKIM, DMARC), brand impersonation, deceptive links and scam language. Lookalike "Google security alerts" land in a Spam folder with a plain-English reason instead of your inbox. It doesn't replace this audit: a forwarding rule set inside Gmail runs on Google's servers whether or not you read mail through AI Emaily, so the three tabs above are still where you check. We build AI Emaily; every plan starts with a 7-day free trial — see AI Emaily pricing.