A colleague sends the monthly price list to a customer. Ten minutes later they notice that the autocomplete picked a different company with a similar name, and the attachment contained the discounts of a third customer. The first instinct is to say nothing and hope the recipient ignores it. That is the worst option, because the clock is already running.
Misdirected emails are among the most common small incidents in any company. This article describes a short routine for the first hour and a few changes that make the next one less likely.
Report it at once
The person who sent the email tells one named person, usually the owner or the manager, the minute they notice. Not at the end of the day and not after trying to repair it alone. The message is short: what was sent, to whom, when, and what was attached.
Make it safe to report. If people fear a reprimand, they wait, and an error that could be solved in ten minutes becomes a problem lasting a week. A simple sentence from the owner helps: "Report it immediately and we will solve it together."
Ask the recipient to delete it
Write to the wrong recipient straight away, politely and briefly:
- Say that the email reached you by mistake.
- Ask them not to open the attachment, to delete the email, and to empty it from deleted items.
- Ask for a one-line reply confirming that it is done.
Do not accuse and do not explain the content. Something like "Please delete it and let me know" is enough. If you know the recipient personally, a short phone call is faster than waiting for a reply. If your email system allows recalling a message inside the same organisation, try it, but do not rely on it for outside recipients.
Judge what was in it
How serious the situation is depends on the content, not on the recipient. Ask three questions:
- Was there personal data, such as names with contact details, health or payment information, or employee data?
- Was there confidential business information, such as prices, contracts or customer lists?
- Was there access information, such as passwords or links that give entry to a system?
If the answer to the last question is yes, change the password or cancel the link first, before anything else. If the email contained personal data, the case may be an incident that needs a formal decision and sometimes a report to the authority. For that situation see a personal data incident in a small company.
A price list sent to the wrong customer is unpleasant but usually manageable. A list of customers with their phone numbers is a different matter.
Who to tell
Decide in the first hour, not in the first week:
- The owner or manager, always.
- The person or company whose information was sent, if their data or prices were included. It is better that they hear it from you than discover it later.
- Whoever looks after your email and IT, if an account may be affected or a password was involved.
When you tell a customer, keep to four lines: what happened, what was in the email, what you have already done and who they can call. The same approach as in apologising to a customer after our mistake works here.
Write it down
Record every case in one line in a shared list: date, what was sent, to whom, what was done and what will change. The list does not need to be long. After a quarter you will see whether the cause repeats, and that is the real value of the record.
Prevent a repeat
Blaming the person who made the mistake rarely helps, because the same mistake is easy for everyone. Look at the causes:
- Autocomplete. Turn it off for external addresses, or at least teach people to check the full address before sending.
- Look-alike addresses. Two customers named "Novak" or two domains differing by one letter are a standing trap. Add a short note to the contact, for example "not the one in Brno".
- Attachments. Send a link with limited access instead of the file where you can, so that access can be withdrawn later.
- Delay before sending. Many email programs can hold messages for one or two minutes. That short pause catches many mistakes.
- Sensitive files. Put a rule on them: a file with a customer list or prices is sent only after a second look at the recipient line.
For regular sending of sensitive documents, a better solution may be a small internal tool that sends to a fixed list of recipients. This is the kind of everyday process where a simple custom solution can remove the risk completely.
What to avoid
- Staying silent in the hope that nobody noticed.
- Sending a second email to the wrong recipient with a long explanation.
- Reacting to the mistake with a reprimand in front of the team.
- Closing the case without changing anything.
- Asking for deletion but never checking that you received the confirmation.
A simple start
- Agree who receives reports of misdirected emails, and tell everyone.
- Save the short "please delete it" message as a template.
- Turn on a delay of one or two minutes before sending outside the company.
- Add the three questions about content to one page that everyone can find.
- Review the list of cases after a quarter and change one habit.
Sources
- This article describes a working routine and makes no statistical claims. The related WVI articles linked above cover personal data incidents and apologising to a customer after a mistake.