On the day someone leaves, change the mailbox password, remove it from their devices and check its forwarding rules. Redirect new mail to a colleague, move logins to a shared address, archive what you need, then close it.

The account nobody closed

An employee leaves on good terms. The laptop is wiped, the keys come back, and the email account stays open in case something important arrives.

Something important does arrive, for months: replies from customers, invoices from suppliers, quote requests from the website, and password reset links for accounts registered to that address.

Nobody reads it. And often it is still set up on the former employee's own phone, still syncing, with the same password as on their last day.

Very few people misuse that access. The risk is that an open, unwatched mailbox is useful to whoever does.

What keeps arriving

The fourth turns a mailbox into a key. Anyone reading that inbox can reset the password on the domain registration, the hosting account, a supplier portal or the business's social pages, and take them over.

Access that outlasts the job

Email set up on a personal phone or home computer keeps working until the password changes. Changing it on the business's side is the only dependable way to stop it.

A former employee who notices is usually honest about it. The concern is the phone that is later sold, lost or handed to a child, and the old password reused on some other site that later leaks.

An unwatched mailbox is also a comfortable place for an attacker, because nobody is there to notice an odd sent message or a new rule quietly copying mail elsewhere.

On the day someone leaves

Change the password, along with any recovery phone number or backup email address on the account, so a reset cannot reach the former employee.

Sign the account out of every device. Business email systems such as Office 365 and Google Apps for Work give the administrator ways to do this remotely.

A mailbox hosted alongside the website is cut off by setting a new password in the hosting control panel.

Check the mailbox's forwarding rules and filters before anything else changes, so mail is not quietly being copied somewhere.

Tell people in advance that this is what happens when anyone leaves. Nobody should be surprised when their phone stops receiving work mail.

Keep the mail flowing to someone

Do not simply delete the account. Customers and suppliers will keep writing to that address for months, and each message that bounces or vanishes is a question nobody answers.

Redirect it instead, by forwarding new mail to a colleague or giving a colleague access to the mailbox. Office 365 can turn it into a shared mailbox that colleagues open alongside their own.

Set a short automatic reply saying the person has left and naming the right contact, so nobody waits for an answer that will not come.

A worked example

A safe and vault dealer with a showroom and two installers sells and services safes for homes, shops and offices. Its longest-serving salesperson retired in the spring.

The mailbox stayed open, in case. It was still set up on the salesperson's own tablet, with a password that had not changed in years.

Over the next three months it received quote requests from the website's contact form, which had always sent there, supplier invoices, and a password reset for the dealer account on a manufacturer's ordering site.

Some of the customer messages described exactly which safe they owned and where in the house it was installed.

The retired salesperson noticed the mail arriving on the tablet and phoned.

That afternoon the dealer changed the password, removed the account from the tablet, pointed the contact form at a general sales address and moved the ordering account to it.

The office manager now watches the old mailbox for three months, after which it will be archived and closed.

Move logins to addresses that outlast people

The deeper problem is that business accounts were registered to a person. Domain registrations, hosting, Analytics, AdWords, social pages, supplier portals and bank alerts often use whoever set them up.

Move each one to a role address on your own domain, such as accounts@ or admin@, that more than one person can read and that never resigns.

Make the list while the person is still there to tell you what they signed up for. Afterwards the mailbox itself is the best record, because the welcome emails are in it.

Archive before closing

The mailbox holds part of the business's history: quotes, agreements, complaints and promises made to customers. Export a copy before the account closes, and keep it somewhere the business can search.

Keep it while warranties, disputes or tax records might call for it, and protect it like any other customer record, since it is full of personal information.

Personal messages will be in there too. Agree with the person before they go how those will be handled.

Then actually close it

After a few months, once redirected mail has slowed to a trickle of newsletters, close the account.

To keep catching stragglers, replace it with an alias that forwards to a role address. An alias has no password and nothing to sign in to.

Accounts for people who have left also cost money on most business email plans, which is a quieter reason to finish the job.

The counter-case

Not every departure needs every step on the first day. In a two-person business where the owner already reads every message, the forwarding and archiving can be simpler.

Nor is a departing colleague a suspect. These steps protect the business from what happens to an unwatched account, not from the person who used it.

But the password and device steps apply to everyone: change them on the day, redirect and archive, then close the account.

The checklist

  1. Change the password and recovery details.
  2. Remove the account from every device.
  3. Check forwarding rules and filters.
  4. Move logins to role addresses.
  5. Point website forms at a shared address.
  6. Redirect new mail to a colleague.
  7. Archive, then close the account later.

Step four is the one that matters most over time. Until every login belongs to an address the business controls, each departure leaves accounts that only a former employee's inbox can recover.

What to look for in a mailbox's rules is covered in forwarding rules set up by someone else.

Frequently asked questions

Should I delete a former employee's mailbox straight away?

No. Customers and suppliers keep writing for months. Change the password and remove devices on the day, redirect new mail to a colleague, archive it, then close it.

Why change the password if they left on good terms?

Because the account may still sync to their own phone or tablet, which can be sold or lost, and an old password may be reused somewhere that later leaks.

What is the risk from password resets?

Accounts registered to that address, such as the domain, hosting or social pages, can be reset by whoever reads the inbox. Move them to role addresses.

What should the automatic reply say?

That the person has left and who to contact instead, with a role address or phone number, so customers and suppliers are not left waiting for answers.

How long should the mailbox stay open?

A few months, redirected to a colleague, until the mail slows to a trickle. Then close it, and keep an alias forwarding to a role address for stragglers.

Do I need to keep the old email?

Export a copy and keep it while warranties, disputes or tax records might need it, protected like any other record that holds personal information.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Former staff mailboxes still open?

Send us a list of the accounts. We will help you redirect, archive and close them without losing customer mail.

Start a Conversation