Blog

Every warning was sent. None were seen.

The technique that turns a compromised inbox into total notification silence

Why the deletion matters more than the break-in

Conventional wisdom says account takeover as a loud event — a password that suddenly stops working, a lockout screen, and a mad scramble to regain control. That’s true when the attacker’s goal is speed. But what if the attacker wants to play the long game?

The unfortunate truth is that someone has a foothold in a mailbox — through a reused password, an old session cookie, or one successful phishing click — the smartest move isn’t to act fast. It’s to make the mailbox look untouched. A short-lived burst of activity draws attention. A mailbox that behaves exactly as it always has draws none. And it can end up being much, much more lucrative.

We call this pattern inbox ghosting: not a break-in defined by what the attacker takes, but by what they make sure the victim never sees.

two quiet techniques, one result

There isn’t a sophisticated exploit behind this. There’s a mail rule.

Attackers set up a filter — often with a throwaway name like “pp” or “s,” designed to blend into a settings menu no one audits — that catches any message containing words like “fraud,” “verify,” “unusual activity,” or “wire” and routes it into a folder no one checks, or deletes it outright. When a rule isn’t set up, the attacker does it manually: sitting on the account and clearing each alert within seconds of it landing. Slower, but just as effective, and it leaves even less behind.

Either method produces an inbox that tells its owner a lie: nothing to see here.

What it costs, and who pays the most

The price of that silence scales with how long it goes unnoticed. Inside organizations, inbox ghosting is what turns an ordinary phishing click into full Business Email Compromise — attackers ride real, ongoing vendor conversations for weeks, quietly redirecting invoices and negotiating payment changes that read as completely legitimate to everyone but the attacker. For individual account holders, it means fraudulent transactions and account changes go unchallenged until a statement finally surfaces them, by which point recovery odds have already dropped.

None of this requires beating multi-factor authentication. MFA can perform flawlessly and still be irrelevant, because the target was never the login — it was whether anyone would be told something was wrong.

What to look for before ruling out inbox ghosting

A handful of patterns tend to show up when ghosting, not a simple missed email, is the real explanation:

• A long, unexplained gap between when fraud actually began and when it was discovered — often measured in weeks.
• A mailbox rule the owner didn’t create: short, unnamed, or vaguely named, routing or deleting anything security- or payment-related.
• Zero recollection of any alert, not partial recall. Someone who genuinely missed an email in a busy inbox usually remembers glimpsing it. A ghosted victim remembers nothing, because there was nothing to glimpse.
• Fraud embedded in a real, pre-existing thread — a known vendor, a known contact — rather than a new message that would have prompted scrutiny.
• No phishing link or malware tied to the fraudulent transaction itself. The actual entry point is often older and unrelated to the event under investigation.

If several of these are present, the mailbox itself — not the transaction — is where the investigation needs to start.

Where to look — and what to stop relying on

Email-based alerting was never built to survive an attacker who controls the inbox it’s sent to. Closing this gap means treating the inbox as a channel that can be silently compromised, not a channel that’s inherently trustworthy:

• Move critical alerts out-of-band: SMS, push, or a live call for high-risk events, so a captured inbox can’t absorb the only warning a customer was going to get.
• Treat new mail rules as a detection signal, not a settings footnote: especially short, unnamed, or filter-everything rules created outside of normal user behavior.
• Watch the mailbox’s behavior, not just its contents: unusual read-then-delete patterns and access from unfamiliar locations both surface a ghosted inbox before the downstream fraud does.
• Verify anything involving money through a second, independent channel: a callback to a number on file, never a reply inside the same thread the request came from.

Our full threat intelligence briefing, The Silent Breach: How Inbox Ghosting Powers Modern Fraud, breaks down the complete detection picture — the rule patterns and manual tactics attackers rely on, the log signals that expose a ghosted mailbox early, and the practical path toward alerting that doesn’t depend on the one channel an attacker might already own.

Every trusted tool eventually gets found. Our job is to be watching when it does. Download the full report here.