The Gmail filter blind spot (forwarding & hidden rules)

Attackers hide invoice threads with filters and forwarding. Here is what owners should check manually, which Google audit signals still matter, and how InboxGuards alarms without claiming it can see every filter.

How attackers hide mail with filters and forwarding

Here is a pattern owners keep missing. An attacker gets into a Gmail or Google Workspace mailbox — a phished password, a reused credential from a breach, or a session left open on a shared laptop. They do not always start by sending a wire request. First they hide the trail.

One move is a Gmail filter: if a message contains invoice, delete it, or mark replies from this vendor as read and archive them. That filter can run on Google servers whether anyone is signed in. Another move is external forwarding or a quiet delegation so copies of mail leave the tenant without an obvious daily login. The owner still sees an empty morning inbox and assumes nothing is wrong, while payment threads and vendor replies never surface.

What owners should check in Gmail settings

Open Gmail, Settings, See all settings, Filters and Blocked Addresses. Investigate any filter that deletes, archives, forwards, or marks mail as read when the account owner does not recognize it. Also review Forwarding and POP/IMAP, and ask whether anyone else has mailbox access they should not.

For Google Workspace, an administrator should also review admin audit activity around the same window: unexpected sign-ins, new app grants, and forwarding events when Google exposes them. Manual filter review and audit review are complementary — one does not replace the other. If expected vendor replies are missing, conversations appear read without the owner opening them, or a real invoice thread went quiet, treat that as a reason to inspect filters the same day.

What audit signals matter and what InboxGuards cannot see

InboxGuards uses supported records Google exposes through its Admin SDK Reports API, such as selected sign-in, forwarding, app-authorization, and administrative events. Those records can surface related compromise activity when Google provides the fields.

The event records used by InboxGuards do not include user-created Gmail filter changes. Google may change editions, APIs, and event coverage, so evaluate current provider documentation and the exact data source a product uses. A malicious filter can conceal mail and may appear alongside other compromise activity, but related activity does not always produce a record available to InboxGuards.

• Supported Gmail forwarding event — checked and alerted when required fields are available
• Supported third-party app grant — checked when Google exposes the event
• Supported sign-in record — checked against configured location rules
• Google hijacked-account and suspicious-login flags — surfaced after Google provides and InboxGuards processes the event
• Repeated failed sign-ins followed by a success — the password-guessing signature, alerted as critical

How InboxGuards alarms without pretending to see every filter

InboxGuards is an alarm on configured supported signals, not an all-seeing shield and not a staffed SOC. It checks supported forwarding, security-verdict, app-grant, password-guessing, and sign-in records at the fastest cadence available on standard Google Workspace plans — no premium security licensing required — and emails plain-English alerts when a rule matches. Provider ingestion delays and API coverage still apply.

A relevant InboxGuards alert can be a reason for an authorized administrator to review filters, but the presence or absence of an alert does not prove whether a malicious filter exists. User-created Gmail filter rules remain outside the current data source and require separate review. Monitoring is $2 per user per month with a 30-day money-back guarantee. Hands-on remediation is not included; an optional $199 flat-fee remediation can be separately authorized.

Why we publish the blind spot on purpose

We would rather lose a sale than sell a story that every Gmail change is visible. Filters stay a manual check. That honesty is the product boundary: an alarm you can trust for the signals it claims. Put an alarm on supported Google signals at inboxguards.com/register or read Google Workspace email security for small teams.