# Does a password reset end a mailbox takeover?

Not always. Attackers who take over a mailbox often set up ways to stay in that survive a new password. Check and remove all of these: active sessions and refresh tokens, which must be revoked explicitly; MFA methods the attacker registered, such as a new phone number or authenticator app; inbox rules that forward mail to an outside address, move messages about invoices or security to an obscure folder, or delete replies; automatic forwarding set in the mailbox settings; app passwords and connected third-party apps with mail access; and delegated access granted to another account. Then look at what was done while they were in: messages sent, files shared, contacts exported. In Microsoft 365 and Google Workspace, the audit log shows these changes with timestamps. Write down what you find, because it determines who has to be warned and whether the incident must be reported.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/does-a-password-reset-end-a-mailbox-takeover

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What are deepfake CEO calls, and how do we protect against them?](https://netsenx.com/en/faq/what-are-deepfake-ceo-calls)
- [What is a fake CAPTCHA or ClickFix attack?](https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack)
- [Are e-mail attachments still dangerous?](https://netsenx.com/en/faq/are-email-attachments-still-dangerous)
- [What does NetSenX see after someone clicks a phishing link?](https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click)
- [What is phishing?](https://netsenx.com/en/faq/what-is-phishing)