What not to send by email, and what to use instead

Why email is risky for sensitive things

• It lasts forever. Messages sit in sent folders, inboxes and backups for years, on both sides.
• It is easy to misdirect. Autocomplete picks the wrong person with the same first name.
• Mailboxes get taken over. An attacker in one mailbox can search years of messages for “password,” “SSN” or “bank.”

What not to send

• Passwords or sign-in codes
• Full bank account or card numbers
• Social Security numbers, passport or driver’s license scans
• Medical or other sensitive personal information about clients or staff

Better options

• Passwords: share them through a password manager, which can share with a specific person and keep a record.
• Documents: share a OneDrive or SharePoint link to specific people instead of attaching the file. You can turn a link off later. You cannot unsend an attachment.
• Encrypted email: Microsoft 365 can send encrypted messages that only the recipient can open, for business plans that include it.
• A phone call for bank details, especially when anything changes.

If you have already sent something

Tell your IT team if it was a password, so it can be changed. For other information, think about where the message now lives, and whether it should be deleted from both ends.