Plenty of people switch on an out-of-office reply before a break without thinking about it. Most write something friendly and helpful. That’s exactly the problem.
An automatic reply doesn’t just go to your clients and colleagues. Microsoft’s own Outlook instructions point out that replies sent outside your business go to everyone who emails you, including newsletters and junk mail. Anyone who sends a test email to your address gets the whole message back within seconds.
What a stranger can learn from yours
Read your usual reply as if you were someone planning to trick your business into paying a fake invoice. A typical one can tell them:
- that you’re away, and exactly when you’re back
- where you’ve gone, and whether you’ll be checking email
- who is covering for you, and their mobile number
- who approves payments while you’re gone
That’s a ready-made script. Scammers who send fake invoices and changed bank details rely on people being busy, rushed or covering for someone else, which is why Scamwatch tells businesses to check payment details by calling a number they found themselves.
We’ve seen how these attempts arrive. A professional services firm we support received a fake invoice asking for payment, and then a second email dressed up to look like it came from someone senior in the firm. Staff spotted it and reported it. Scams like that work better when the scammer already knows who’s away and who’s in charge.
The one habit
Keep the reply that goes outside the business to two things: the day you’re back, and a general contact.
Something like this does the job:
Thanks for your email. I’m out of the office and back on Tuesday 6 October. For anything urgent, please call our office on the main number.
Leave out your mobile number, your travel plans, and the names of anyone who approves payments.
Use the two versions Outlook gives you
Outlook lets you write a different reply for people inside your business. That one can name who’s covering and how to reach them, because it only goes to colleagues.
Two settings are worth using as well:
- Send replies only during a time period, so the reply switches itself off when you’re back.
- Send replies only to contacts, so outside replies only go to people already in your contacts.
Five minutes before you leave is all it takes.
If you’d like help setting sensible defaults for your team’s automatic replies, get in touch.