Mitigating the risk of emails to the wrong recipient

[djrscally]

I reckons this is one of the biggest risks for us. Problem is, I'm not entirely sure what's the best way to mitigate it. What's everyone doing to try and stop that from happening?

 

The one idea I have is to find an Outlook add-on that prompts you to confirm the recipient is correct before actually sending an email externally, and to configure it to share attachments as OneDrive links so access can be revoked if you realise you made a mistake. Past that though, I'm not sure what to do.

[FN-GM]

What email system are you using?

 

We use Gmail and have done a few things.

 

1. Enable the Undo Send. It will allow you to stop a message within 30 seconds of it being sent.

2. We put different Icons on staff and student accounts. It should prevent messages being sent to students instead of a staff member with a similar name.

[andy_b]

We have this mailtip enabled in Office 365 to prompt the users:

 

https://newsignature.com/articles/dont-send-that-enable-mailtip-for-external-recipients-in-office-365/?lang=gb

[djrscally]

What email system are you using?

 

We use Gmail and have done a few things.

 

1. Enable the Undo Send. It will allow you to stop a message within 30 seconds of it being sent.

2. We put different Icons on staff and student accounts. It should prevent messages being sent to students instead of a staff member with a similar name.

 

 

Outlook, we do also do #2. #1 I use personally but for a different reason, but yeah that might be a good idea.

 

We have this mailtip enabled in Office 365 to prompt the users:

 

https://newsignature.com/articles/do...e-365/?lang=gb

 

Ah - I was looking for something like this. I'd still rather a "tick to confirm you've looked at the recipients list and that specific recipient is ok" but this is a very decent start - thank you!

[MrWrighty]

At the moment we have a 5 minute delay before email is sent. This generally works as most senders realise their mistake fairly quickly after hitting the send button. I also wrote a script that would check certain domains for a user and would prompt them if they were sending to a domain that was not on the whitelist, however Outlook had a tendency to break the script over time and fail to inform the user.

[djrscally]

At the moment we have a 5 minute delay before email is sent. This generally works as most senders realise their mistake fairly quickly after hitting the send button. I also wrote a script that would check certain domains for a user and would prompt them if they were sending to a domain that was not on the whitelist, however Outlook had a tendency to break the script over time and fail to inform the user.

 

I looked at that but annoyingly we almost exclusively use the Outlook Web App and it's a bit tougher there. Might end up writing my own extension for it in the end since I can't seem to find one.

[enjay]

We use Gmail and have done a few things.

 

1. Enable the Undo Send. It will allow you to stop a message within 30 seconds of it being sent.

 

I've enabled that too. One problem I've found is if you navigate away to a different folder after clicking Send, the "undo send" link disappears.

 

We have added "(student)" to the end of every student's name in the address book, which makes it more obvious when you're picking up a student with a similar name to a staff member (we've had several of those).

 

Ultimately, the mitigation steps for this are mainly human - check, check and check again, especially if sending personal or sensitive information.

 

Also, advise caution when using "reply all" which is the default option on GMail mobile app (I think). We have had an instance of a message which was forwarded to some colleagues and copied to the parent for info - one of the staff replied all with a message which shouldn't have gone to the parent. Fortunately, nothing too bad but it could have been.

[Edutech98]

We disabled the suggested names whilst completing To, CC and BCC fields so the person needed to type out the full email address (or manually search the address book). Although this caused a mini riot at the time!

[k-strider]

We have this mailtip enabled in Office 365 to prompt the users:

 

https://newsignature.com/articles/dont-send-that-enable-mailtip-for-external-recipients-in-office-365/?lang=gb

 

 

Me too

[TwistedHelixis]

We use parent communication software that batch send all emails but actually sends then as separate emails. The software pulls all its email addresses from Sims but you can add your own for external emails. I am not at the school at the moment and can't for the life of me remember the name but will post it when I do.

[sonofsanta]

You can recreate the Undo Send functionality (i.e. delayed send) in Outlook through this guide: https://support.office.com/en-us/article/delay-or-schedule-sending-email-messages-026af69f-c287-490a-a72f-6c65793744ba#__toc294769135

[clareq]

I'm trying to create a mailtip that pops up if the sender is in the Staff group, and the recipient is a student, but I get this error: "Error details: The NotifySender action isn't compatible with 'SentToMemberOf' predicate." Is there something I'm missing?

[3s-gtech]

Our students are removed from the address lists in Exchange, so they don't show up. Of course, it's more of a pain to email them, but staff can easily look up their usernames if needed.

[enjay]

I wonder if you're looking for a technical solution to a human problem here. Is it not better to drill into people to check the recipient list carefully? Even if we configure the system so staff can't accidentally email students, they still have the potential to pick the wrong name from their contacts - one of our suppliers used to email me in error quite frequently because I have the same name as one of their colleagues. No technical system could prevent that sort of error.

[Edutech98]

^^ Its a good point! Although defence in depth so if possible put in place organisational controls (i.e staff training) and technical controls (i.e all of above!)

[enjay]

Agreed, technical and organisational controls, but you also need to consider the impact of the technical measures on day-to-day operations and find a balance. If the technical measures involve hiding students' addresses so staff have to look them up in SIMS before sending an email, I would say, you've gone too far.

 

It reminds me of this Dilbert cartoon - https://i.pinimg.com/originals/b7/15/b2/b715b275e30031ea2062440f34d4081f.gif

[Edutech98]

Yeah great point and I think your spot on about its finding that balance.

[mavhc]

Maybe before sending you can force a user to pick a classification for the email, and then apply more rules based on that "you picked "contains personal information", are you sure you want to send that to ?"