protect, monitor or wipe. Every forwarded message, from client contracts to password-reset links, now lives somewhere outside your company's security controls. The same feature is also a favourite tool of attackers, who quietly set up forwarding rules after breaking into a mailbox.
Most people who set up forwarding aren't trying to cause harm. They just want one inbox. But convenience for one person can turn into a data breach for the whole company.
TL;DR
It moves data out of your company's control. Your personal account has none of your employer's security, retention or deletion policies.
It can break the law or your contract. Many privacy and industry rules restrict where business and customer data can go.
It doubles your attack surface. If your personal account is hacked, your work email is too.
It outlives your job. Forwarding often keeps running after you leave.
Attackers use it. Hidden forwarding rules are a classic sign of a compromised mailbox.
Better option: add your work account to your phone's mail app or use webmail with two-factor authentication.
Why people forward work email (and why it backfires)
The reasons are understandable:
One inbox feels simpler than two.
The personal email app on their phone is easier to use.
They want a copy of their work "just in case."
Their work mailbox is full, so a personal account becomes overflow storage. (If that's you, our guide to cleaning up a full mailbox is a safer fix.)
The problem is what happens to the data once it leaves.
The 5 biggest risks of auto-forwarding work email
1. Company data leaves the company's control
Inside a business mailbox, your employer controls encryption, access, retention and deletion. A personal account has none of those policies. If a laptop is stolen or a project ends, IT can lock or wipe a work account, but it can't touch copies sitting in your personal inbox.
2. It can break privacy laws, contracts and industry rules
Customer details, health information, financial records and contracts often come with rules about where they can be stored and who can access them. Laws such as GDPR, and sector rules in healthcare, finance and law, generally expect organisations to keep that data under their control. Copying it to a personal account can turn an ordinary email into a reportable incident, and many employment contracts and IT policies forbid it outright.
3. Your personal account becomes a back door
Personal accounts are often protected by reused passwords and no two-factor authentication. If one is breached, the attacker gets everything forwarded to it, including password-reset links for work systems. Our guide to phishing protection and TLS encryption explains how these attacks start.
4. Forwarding outlives your job
Forwarding rules are easy to forget. When an employee leaves, a rule they set years ago can keep sending sensitive mail to a former staff member, or to an old account nobody checks anymore.
5. Encryption doesn't follow the message
Encryption protects mail inside a secure system. Once a copy is forwarded to an outside provider, it's governed by that provider's security instead. Our guide to email encryption for business covers why that matters for confidential mail.
How attackers abuse forwarding rules
Auto-forwarding isn't only an employee habit. It's one of the first things attackers set up after stealing a mailbox password, and security frameworks such as MITRE ATT&CK list malicious forwarding rules as a known technique.
[embed: node/3c3d6f2d-fb49]
The rule is the dangerous part. Even if the user changes their password later, a forwarding rule can keep copying mail to the attacker until someone finds and deletes it. Attackers often hide their tracks by moving forwarded messages straight to an obscure folder or deleting them, so the victim never notices.
This is the engine behind many business email compromise (BEC) scams: the attacker watches real invoice conversations, then steps in at the right moment with "updated" bank details.
Warning signs of a malicious forwarding rule:
Replies to emails you don't remember sending.
Messages going missing or appearing as already read.
Forwarding or inbox rules you didn't create, especially ones forwarding to unknown addresses or deleting mail.
Sign-in alerts from places or devices you don't recognise.
Safer alternatives to forwarding
You can get the convenience without the risk. Pick whichever matches why you wanted to forward in the first place.
What you want | Instead of forwarding, do this |
|---|---|
Work email on your phone | Add your work account to your phone's mail app, or use your provider's webmail in the browser |
One place to check everything | Add both accounts to the same mail app; they stay separate but sit side by side |
Never miss urgent mail | Turn on notifications for your work account, or for VIP senders only |
Cover while you're away | Set up an out-of-office auto-reply and name a colleague to contact |
A copy of your work | Ask IT how your mail is backed up and retained; don't build your own archive |
More storage | Clean up large attachments or ask for a bigger mailbox |
Whichever you choose, protect your work account with two-factor authentication and a unique password. That one step blocks most account takeovers before a forwarding rule can ever be created.
Is it ever okay to forward a work email?
Forwarding a single, non-sensitive message by hand, with your employer's permission, is a different thing from an automatic rule that copies everything. If you're unsure, ask your IT team or manager first, and check your company's acceptable-use policy.
For IT admins: how to block and detect auto-forwarding
A written policy helps, but technical controls are what actually stop data leaving. Aim for four layers.
1. Block automatic forwarding to external addresses
Most business email platforms let admins turn off automatic forwarding outside the organisation.
Platform | Where to look |
|---|---|
Microsoft 365 | Microsoft Defender outbound spam filter policy, "Automatic forwarding rules" setting. Microsoft's default system-controlled setting blocks external auto-forwarding for most tenants. |
Google Workspace | Admin console → Apps → Google Workspace → Gmail → End User Access → Automatic forwarding |
Other providers | Look for "external forwarding," "auto-forward" or "mail flow" settings in the admin panel |
If some teams genuinely need external forwarding, allow it only to specific approved domains rather than everywhere.
2. Audit existing rules
Blocking new forwarding doesn't remove rules that already exist. Review every mailbox for forwarding addresses and inbox rules that forward, redirect or delete mail, and remove anything that isn't approved.
3. Alert on new forwarding rules
Set up alerts for any newly created forwarding or suspicious inbox rule, especially right after a sign-in from a new location. That's often the first visible sign of an account takeover.
4. Close the doors attackers use
Require two-factor authentication for every account, ideally with security keys or an authenticator app.
Authenticate your domain with SPF, DKIM and DMARC so attackers can't easily spoof your address. See our guide to domain authentication.
Check forwarding during offboarding. Remove forwarding rules and revoke access the day someone leaves.
Train staff to spot phishing and report odd rules or sign-in alerts.
Write it down
Add a clear line to your acceptable-use policy: work email must not be automatically forwarded to personal or external accounts. Explain why, offer the safer alternatives above, and staff are far more likely to follow it.
FAQ
Is it okay to forward work emails to my personal email?
Generally no, especially automatically. It moves company data outside your employer's control, may breach privacy rules or your contract, and creates a second account attackers can target. Ask IT before forwarding anything.
Can my employer see if I forward emails?
Usually yes. Admins of business email systems can see forwarding settings and inbox rules, and many receive alerts when external forwarding is set up.
Why is auto-forwarding a security risk?
It copies every message to an account without your company's security controls, multiplies the impact if either account is hacked, and is a technique attackers use to read mail silently after an account takeover.
How do I check if someone set up forwarding on my email?
Open your mail settings and look at forwarding and inbox rules. Delete anything you didn't create, change your password, turn on two-factor authentication, and tell your IT team.
How do I get work email on my phone without forwarding?
Add your work account to your phone's mail app or use your provider's app or webmail. You get the same convenience while the data stays inside your company's systems.
How do admins block external email forwarding?
Most business email platforms have an admin setting to disable automatic forwarding to outside addresses, with optional exceptions for approved domains. Pair it with audits of existing rules and alerts on new ones.
Keep work email where it belongs
The easiest way to stop risky forwarding is to give your team business email they don't want to escape. NevTan Mail is secure business email on your own domain, with web and mobile access, end-to-end and zero-access encryption, TLS on every connection, two-factor authentication with security keys, and Sentinel monitoring for suspicious account activity. Admins get central controls to manage users and security from one place. Learn more on our security page.
Check business email pricing, start with free business email, or see how NevTan compares as a Google Workspace alternative or a Microsoft 365 alternative.
