Out-of-office replies and email forwarding: what to do instead of the risky habits

What an out-of-office reply gives away

Automatic replies go to anyone who emails you, including scammers who send messages specifically to harvest them. A reply saying you are overseas until the twentieth, with your mobile number, your manager's name and title, and a note that urgent payments should go to the accounts team, hands a fraudster a ready-made script. They now know who to impersonate, who to target and how long you will be unreachable to confirm anything.

Invoice and payment fraud, where a criminal persuades staff to change a supplier's bank account or pay an urgent invoice, is one of the most costly cyber crimes reported in New Zealand. The timing often coincides with a decision-maker being away. Not every automatic reply needs the same care. A junior staff member's reply is less useful to a fraudster than the owner's or the finance manager's. Pay the most attention to replies from anyone who approves payments, signs contracts or can change banking details, because those are the people criminals most want to impersonate or catch off guard.

Writing a safer automatic reply

Keep external replies short: you are away and will reply when you return, and for urgent matters contact a role address such as office@ or accounts@. Avoid exact travel plans, the reason for absence, personal mobile numbers and detailed names and titles. Internal replies, which Outlook lets you set separately, can carry more detail, because colleagues need it and it does not leave the organisation. Set an end date so the reply switches off automatically. Plenty of mailboxes still announce a holiday from two years ago because someone forgot to turn it off, which looks careless and keeps confirming to spammers that the address is live.

Why auto-forwarding is risky

Forwarding work email to a personal Gmail or Hotmail account feels convenient, but it copies client information, staff matters and financial details into an account the business does not control, with security settings it cannot see. Under the Privacy Act 2020, that may count as a privacy breach if the personal account is ever compromised. When the person leaves, the forwarded mail stays with them.

Attackers also create forwarding rules after breaking into a mailbox so they keep receiving copies even after the password is changed. Because of this, newer Microsoft 365 setups block automatic external forwarding by default, and many older tenants have been switched to block it too. If someone says their forwarding stopped working, that is usually why, and it should stay blocked.

Better ways to cover someone's inbox

For a planned absence, give a colleague delegate access to the person's inbox and calendar, so they can check for urgent items and reply on their behalf without anything leaving the organisation. If the work arrives via a role address such as sales@, make sure it is a shared mailbox that the cover person already has access to. Both approaches keep an audit trail and can be removed when the person returns.

If the person is away long term, such as parental leave, consider an internal forwarding rule to their manager, or a short automatic reply pointing senders to a colleague. Internal forwarding within your own organisation does not carry the same risks as external forwarding. Tell clients and suppliers about long absences directly where the relationship matters. A short personal email to key contacts, naming who will look after them, is better customer service than an automatic reply, and it means your most important correspondents already know who to deal with before they hit the out-of-office.

When forwarding to outside is genuinely needed

Occasionally there is a real business reason to forward externally: a bookkeeper at an outside firm who processes your supplier invoices, or a system that needs a copy of certain notifications. Make these exceptions specific. An administrator can allow forwarding for one mailbox, to one destination, while it stays blocked for everyone else. Record why the exception exists and review it each year. Often a better answer is giving the outside person a guest account or a licensed account in your organisation, so they read the mail where you can manage access, rather than copying it out.

Check for rules after any suspicious activity

If a staff member reports a strange login prompt, a password reset they did not request, or contacts receiving odd emails from them, check their inbox rules and forwarding settings as well as changing their password. Attackers rely on hidden rules to stay in. An administrator can list all mailboxes that have forwarding set up in a few minutes, which is worth doing periodically even without an incident. Make it part of your routine to remind staff before holiday periods: short automatic replies, no external forwarding, and a named colleague covering urgent matters. That message, sent before Christmas and the school holidays, prevents most of the problems described here.