Incoming gmail goes straight into trash.

My wife had her Gmail account hacked some time ago. Google admin shut down the account for a couple weeks before reinstating it. They restored the account after she proved it was her account.

When her account was restored though, it now forces 95% all incoming mail to the "trash" even though it is from trusted emails and replies to her emails.  She uses Safari browser.
LVL 5
Randal RedbergEE Managing MemberAsked:
Who is Participating?
 
Andrew LeniartConnect With a Mentor Senior EditorCommented:
I still strongly recommend deleting all filters to ensure that all bases are covered. It's possible a filter can be valid and just not working correctly. In such a scenario, much time can be saved by removing all filtering, checking to ensure the problem has been resolved and -then- reconfigure any necessary filters. This way, if a corruption does exist, it's eliminated from the start.

The filters were probably created by mistake by your wife. It's a feature of Gmail to be able to set filters on the fly. Not a very helpful feature at times, unfortunately.

Hope that helps.
0
 
slightwv (䄆 Netminder) Commented:
A lot of times compromised email accounts are set to filter traffic to folders to keep the owners from seeing covert traffic.

See if there is a filter still in place:
Open Gmail.
At the top right, click Settings .
Click Settings.
Click Filters and Blocked Addresses.
Find the filter you'd like to change.
Click edit or delete to remove the filter. If you’re editing the filter, click Continue when you’re done editing.
Click Update filter or OK.

https://support.google.com/mail/answer/6579?hl=en
3
 
Randal RedbergEE Managing MemberAuthor Commented:
Thank you, it appears that there was a filter on incoming messages.
0
Firewall Management 201 with Professor Wool

In this whiteboard video, Professor Wool highlights the challenges, benefits and trade-offs of utilizing zero-touch automation for security policy change management. Watch and Learn!

 
slightwv (䄆 Netminder) Commented:
Happy to help!
0
 
slightwv (䄆 Netminder)Connect With a Mentor Commented:
I apologize for not including this in the original post.

If she hasn't already done this (no order because they are all equally important):
    - Change ALL passwords that might have even been close to the compromised one.
    - Change ALL passwords on accounts that have her GMail account as part of their registration.
    - Enable two factor authentication on the GMail account.  It is a pain at first but you can trust systems so you don't get nagged every time.
1
 
Randal RedbergEE Managing MemberAuthor Commented:
Filters and Blocked Messages tab
0
 
Randal RedbergEE Managing MemberAuthor Commented:
So this morning I checked her inbox and ALL incoming mail was again going straight to trash. No emails were going to her inbox. I included a screenshot of her Filters and Blocked Addresses Tab. I sent a test email, (from my email that she has received many times) to her email and it went straight to trash.
0
 
slightwv (䄆 Netminder) Commented:
Sorry but I'm far from an Expert on GMail and what all it does and why.

I am familiar with what bad guys do with compromised accounts.

There is similar chatter about automatic trash here:
https://productforums.google.com/forum/#!msg/gmail/l49QXXAmsSc/1wvIfsTpvIAJ

Check for auto forwarding.  It should be the next tab over in the screen shot.
0
 
Randal RedbergEE Managing MemberAuthor Commented:
Ok, so I have tried the suggestions in the Google product forums but still no resolution on the issue at hand. Everything keeps pointing to filters but I cannot see any filters that are applied to incoming mail.
0
 
Andrew LeniartSenior EditorCommented:
Hi Randal,

Could be that your wife's filter settings are corrupt on the Gmail server. In your screenshot here, it appears she has three filters set.

I would suggest deleting all filters and then seeing if that resolves the issue. If it does, then re-create the filters she needs again.

Hope that's helpful.
0
 
Blue Street TechConnect With a Mentor Last KnightCommented:
Hi Randal,

...but I cannot see any filters that are applied to incoming mail.
All three (3) filters are set for incoming email!

The screenshot you have shared of the Filters & Blocked Addresses page shows exactly why this is happening. Gmail is accurately following the filter rules that someone created (intentionally or unintentionally). At least the first two (2) rules should be selected and deleted. Change her password, enable 2FA (Second Factor Authentication), sign out, then sign back in and verify there are no more Filters in the Filters & Blocked Addresses page.

The 1st filter reads all email sent to experts-exchange.com will be marked as read, deleted, and never sent to spam.
The 2nd filter reads all email matching New sign-in from Firefox on Mac will be marked as read, deleted, and never sent to spam.

I'm assuming she does want EE mail otherwise it would be a better practice to unsubscribe than to create this rule. The second filter shouldn't be created either for security reasons and because it is too ambiguous. The actual email sent from Gmail letting her know that someone has signed in from a new machine should always be evaluated...because if she didn't her account has been compromised. The phrase doesn't look like it was set to Exact so this means any part of the email can be filtered using any of the words.

Once you login to her account (https://myaccount.google.com) do you see a red bar at the top of the page stating, "Warning: Google prevented a suspicious attempt to sign in to your account using your password. Review activity now" if not go to the Security Checkup and follow the prompts. This is where you can activate 2FA as well as changing her password.

Let me know if you have any other questions!
0
 
Blue Street TechLast KnightCommented:
Agreed Andrew! I was just elaborating on how the first two are causing the most modifications in the inbox.

The 2nd rule is most alarming to me though. This is a security precaution email letting the user know someone has logged in from a new device. The rule was written poorly but my security flag goes up. Why would someone ever want this auto deleted unless they are trying to remove their tracks.

That is why I suggested to reset her password and enable 2FA.
0
 
slightwv (䄆 Netminder) Commented:
Randy,

If removing ALL filters doesn't fix things:   Did you check the Forwarding and POP3 settings from the link I provided?

I don't want to set up forwarding to test it but the POP3 has an option to delete GMails copy.  If that goes to trash or not, I'm not sure.

You might also check the add-ons tab to make sure they didn't add something that might be doing this.

>>That is why I suggested to reset her password and enable 2FA.

re-suggested?  ;)
1
 
Randal RedbergEE Managing MemberAuthor Commented:
Removed all filters. I will see how that affects the incoming messages to her inbox.
0
 
Randal RedbergEE Managing MemberAuthor Commented:
Thank you guys for helping. She is back on track.
1
 
Andrew LeniartSenior EditorCommented:
Good to hear! Happy I could help out. :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.