Old email accounts are often the weak links in business security. They can hold sensitive information, provide a way for cybercriminals to access your systems, and, if compromised, could damage your reputation or even lead to financial losses. Let’s talk about why you need to either secure or remove these abandoned email accounts.

The Ghosts of Business Past

Many businesses set up email forwarding when an employee leaves or a department closes. For example, emails sent to jenny@yourbusiness.com may now go to admin@yourbusiness.com so that nothing important is missed. That’s a good short-term fix, but what about the original jenny@yourbusiness.com mailbox? If it still exists and can be logged into, it’s a security risk.

READ MORE: What is the Most Secure Way to Share Passwords with Employees

Attackers love old accounts because they tend to have weak or unchanged passwords, making them easy targets. If that account is compromised, an attacker could reset passwords for linked services, impersonate former employees, or even launch phishing scams on your behalf.

A Treasure Trove for Hackers

Think about what’s sitting in that inbox. It could contain:

• Customer details and sensitive communications.
• Financial documents and invoices.
• Internal business strategies and trade secrets.
• Vendor contacts and business relationships.
• Forgotten login details or password reset emails.

In short, that forgotten inbox may be more valuable to a hacker than you realize. If it has never been purged or properly secured, it’s like leaving the front door of your business unlocked.

The Password Problem

One of the biggest dangers with abandoned accounts is password reuse. The last user may have used the same password elsewhere, and if that service has suffered a data breach, the credentials for the old email account could already be floating around on the Dark Web.

Even if the password wasn’t reused, has it been changed recently? Many businesses don’t regularly update passwords for inactive accounts. A compromised email account can give hackers a way into your entire business network.

What Should You Do?

Ignoring old email accounts is not a risk worth taking. Here’s what you should do to fix the problem.

1. Audit Existing Email Accounts: Take stock of all business email accounts. Identify which ones are actively used, which ones are forwarded elsewhere, and which ones are no longer needed.
2. Secure What You Need to Keep: Some old accounts might still serve a purpose. If so, they should be secured with strong, unique passwords and multi-factor authentication (MFA).
3. Delete What You No Longer Need: If an email account is no longer necessary, don’t just leave it sitting there. Delete it properly to remove the security risk.
4. Implement a Formal Offboarding Process: Make sure every time an employee leaves or a department closes, their email account is handled appropriately. Either migrate essential data to a secure location or delete it immediately.
5. Work with an IT Professional: Handling old email accounts isn’t just a cleanup task; it’s an important part of securing your business. We can help you identify and eliminate risks, ensuring that no forgotten account becomes a backdoor for cybercriminals.

READ MORE: 6 Simple Steps to Enhance Your Email Security

Protect Your Business Before It’s Too Late

The longer old email accounts are forgotten, the bigger the risk becomes. A single compromised account can lead to a data breach, financial loss, or reputational damage. Taking action now is the best way to keep your business safe.

To start, migrate your email to one of the big-name providers. Google Suite and Microsoft 365 work hard to filter out spam before it even gets to your mailbox. Google says its AI-enhanced spam blocks nearly 10 million spam emails every minute. Local internet service providers are unlikely to have that level of anti-spam sophistication.

READ MORE:  6 Reasons to Replace Your ISP Email

If you own your domain name, set up catchall email addresses to help filter messages. You might own joesmegashop.com. Instead of having everything go straight to joe@joesmegashop.com, you assign addresses for specific sites. For Facebook communications, you would set up facebook@joesmegashop.com as the address. You’ll still get the emails, but you’d know it’s from Facebook. Or you’d know Facebook sold your email address to someone else. You can still block any email you don’t want at facebook@joesmegashop.com.

Even if you don’t own your domain, you may still be able to use the catchall-address approach. Gmail is a popular service that allows you to put a plus after your email name. So, you could protect your joe@gmail.com address by using joe+facebook@gmail.com. Gmail ignores everything after the plus, so it’ll still go to joe@gmail.com. But now you’ll know who leaked your Joe+facebook address. You can block any emails going there if it becomes a problem.

READ MORE:  Hopedale Technologies Web Services

Blocking E-mails
To block a sender in Gmail, open the message and click on More in the top right. Click on “Block [sender]” in the dropdown. To do the same on Microsoft 365, right-click on the sender’s message and click “Junk” and “Block Sender.”

If you change your mind about any of your blocked senders in the future, you can unblock them on either platform.

More Ways to Limit Spam
Don’t list your email as plain text on your business website. You could use a contact form to avoid exposing your email address to anyone online. If you don’t want to add a hurdle for legitimate contacts, show your email address as an image instead of text. This stops website-scraping bots from reading and adding your email address to spam databases.

When you get a spam email, block that address and report the email as spam to your provider. This helps them to boost their filtering.

READ MORE:  Protect Yourself from Phishing

It’s also worth the few seconds it takes to unsubscribe from unwanted mailing lists. Look at the top and bottom of the email you’ve received for an “Unsubscribe” link. You should be a simple click away from one less mailing in your already crowded inbox.

If you do get a suspicious email, delete it. Don’t reply to an email asking you for personal or financial information, and don’t click on links in that message.

Need help corralling your inbox and strengthening your security? Hopedale Technologies can help protect your business from spam and malicious cyberattacks. We offer Hosted Email Exchange and Security and Office 365 for home and business.

There are many reasons someone might decide to endure changing their email address. These include:

• losing access to the old one and not being able to recover that account;
• changing your internet service provider (ISP);
• having to stop using a professional email for personal messages too;
• falling victim to identity theft;
• deciding to give yourself a more professional email by changing your address from yourbusiness@yahoo.com to you@yourbusiness.com;
• not feeling as proud of your hotbabycakes@hotmail.com address now that you’re over 14.

Whatever prompts your move, try these tips to avoid missing mail and risking account compromise.

READ MORE: Why You Should Never Use a Free Email Address for Your Business

Notify your contacts of the change

You will probably be amazed at the number of people in your contacts folder. Still, you can make the change more manageable by letting your friends and family know you have a new email address.

When you send a message to your contacts, respect people’s privacy. Send your update with their names in the blind carbon copy (BCC) line.

Migrate your old inbox

Most domain providers make it simple for you to migrate your old emails and contacts. Once you set up the new account, you’ll typically be able to go into Settings and find an option to import your old data. You may have to migrate the inbox and the contacts separately.

Don’t move on too quickly

You may be ready to move on, but don’t delete that old email address too soon. It’s a common mistake. Instead, try to hold onto your old email as long as possible. You don’t have to continue using it, but if you still have access, you can:

• set up forwarding so that any emails to your old address will go to your new one;
• see what emails are still coming to identify accounts you might have forgotten to change.

Inventory all accounts using that address

Use a password manager? We recommend its convenience. Plus, you can search there for accounts using the old address. The password manager can be a landing page for you to jump to all those accounts and make the necessary changes. We use LastPass at Hopedale Technologies to manage our passwords.

READ MORE:  The Unexpected Benefits of Password Managers

Inspect your trash and old emails

Review your trash and sent emails to help you think of other sites connected to the old email address.

Think also of accounts that may use that email address for recovery. For instance, you may have set the old account as a backup for PayPal, online banking, or streaming services. If you don’t change the recovery address, you might have difficulty regaining access to that account.

You might wonder why you should bother doing this. If you don’t, someone could claim your old account and gain access to your connected accounts. If you press a recover password link on a banking site, that email will go to that person instead of to you!

READ MORE:  Which Form of MFA Is the Most Secure? Which Is the Most Convenient?

Get help making the email move

The many little things to take care of when you change your email can make this a big deal. Hopedale Technologies is here to help. We can set you up for simple, secure email communications in the future. Hopedale Technologies also offers Hosted Email Exchange and Security for business.

First, what is email spoofing? Don’t confuse this with the foreign prince’s plea for money or basic phishing emails. Email spoofing is much more nuanced; it’s still a cyber-bad guy at work. They try to get you to download malware, enter personal credentials, or give money. Yet now they are mimicking a reputable company or source of an email. At a hurried glance, the email will appear to be legitimate, and that’s how it works. The spoofer takes advantage of our lack of attention to accomplish their aim.

The scammer tries to trick you into thinking they are a source you recognize with email spoofing. The source might be a friend, colleague, or other business you regularly work with. Their goal is to get you to take an action you would not otherwise do.

The email will usually look convincing. The would-be attacker will duplicate design elements and mimic the sender’s style. So, you need to be aware.

How to Identify Email Spoofing

There are several signs to look for to identify a spoof email. First, you’ll want to check the email header information. This is an excellent place to look for tracking information about the message.

To view headers:

• In Gmail, open the email you want to check. Next to Reply, click the three dots and choose “Show Original.”
• In Apple Mail, open the email you want to see headers for, and click View > Message > All Headers.
• In Outlook, open the email you want to check, and then click File > Properties.

Check to see:

• if the “from” email address matches the name of the person displayed as the sender;
• that the “reply-to” address is the same as the sender or the site that the email purports to be from;
• that the “return-path” is the same as the reply-to – you don’t want to think you are replying to “John Doe” when your response will go to “Scammy McScammer.”

The email header is a good starting point, but you’ll also want to ask yourself about the content of the message. If you weren’t expecting a message from that individual or organization, think twice. Also, look out for spelling or grammatical errors. A difficult-to-read message could indicate an unsolicited email from someone with a limited grasp of English.

Be wary if the email pressures you to act quickly or make an emotional plea for you to do something. Scammers often rely on urgency or our desire to help. That’s how they trick people into clicking on links or open attachments.

Better Safe Than Sorry

If you aren’t sure about an email’s legitimacy, slow down. Before you act, go to your contact list and send a direct message to that sender’s address to confirm the request. Or call the sender or company the sender represents to verify that the email is authentic.

A managed service provider (MSP) like Hopedale Technologies can help you better manage email safety. We can help set up email filtering and monitoring to avoid malware infection. 

So how can we deal with this overload? The first step is to reduce the number of emails you receive overall and there are a few ways to do this.

Restrict who you give you email address to.

It’s important to think carefully about who you give your email to. For example, if you enter a lot of contests, this often automatically subscribes you to several email campaigns. If you type your email into every popup box asking for it, these add up. Reduce who you give your email to.

Unsubscribe

Go through your inbox and unsubscribe to newsletters that you never read (hopefully not ours). If you haven’t opened one of their emails in months, chances that you’ll start to later are low. Turn off notifications from social networks such as Facebook, Twitter, and Pinterest. If you like emails from these networks, then at least adjust the settings so they email you highlights once a week or month rather than allowing them to spam your inbox several times per day.

Do you need that notification?

If you receive emails that contain information you can find elsewhere, switch those notifications off. For instance, you might run an e-commerce site that sends an email for every sale. If your website already has a record of this, you don’t need it in two places. Make sure not to use your email as a to-do list. When you need to remember to do something, put that on a list elsewhere to clear up your inbox. If this is a hard habit to break, at least make a folder for things you need to do and move emails there and out of your general inbox.

Change your email habits

Change your own email sending habits. If a topic is complex and will require a lot of back and forth conversation, consider discussing it in person or over the phone. Sending fewer emails will reduce how many you receive in return. Remember that you don’t need to respond to every email you receive. A response indicates a willingness to continue to conversation.

Resist the urge to send messages with a single word like “Thanks!” or “Ok” and you’ll notice others will stop sending you similar, unnecessary messages. When sending group emails, you can also remind others not to use “reply all” unless it’s information relevant to the entire group.

Start clearing out

Now you can start emptying out your inbox and getting rid of any old emails you don’t need to keep. Delete old calendar invites, advertisements, or any emails where the problem has already been resolved. Respond to any messages that can be answered within only a few minutes. File everything that is left until you have a completely empty inbox. Archive messages where you don’t need to take an action, but you think might be useful. You can search and find these later if necessary. Put other emails into folders based off of the type of email and the priority level.

From now on, all of this can be automated. You can have receipts automatically go into a receipt folder, calendar invites go into another, etc. A cluttered inbox leads to your mind feeling just as cluttered. Free up your inbox to free up your mind and create more time in your day-to-day life. Let email overload become something of the past.

Hopedale Technologies offers email services that can help prevent spam and phishing scams through basic email or enterprise plans hosted with Microsoft Exchange.