Who's Holding the Keys to info@? A Shared Inbox Health Check

Every small UK team has one: the inbox that does the heavy lifting. info@ handles enquiries, sales@ catches quote requests, accounts@ gets the invoices nobody wants to own. It feels efficient. It also tends to be the least audited piece of kit in the business.

That is the awkward bit. A shared inbox is not just an email address. It is a small system with users, permissions, rules, recovery routes and usually a password that three people know and one person wrote on a sticky note in 2023. If a scammer gets into it, they do not just read the post. They can reply as the company, reset other accounts, set up forwarding and quietly wait for the next invoice thread.

So before the next "urgent" message lands, treat info@ like what it is: a shared liability with a friendly name. Here is a practical health check for 2026.

Start with a guest list, not a password reset

Most teams cannot secure a shared inbox because they cannot describe it. Start by listing every generic address in use: info@, sales@, support@, accounts@, admin@, enquiries@ and any aliases that quietly point at the same place. Include the ones that appear on old invoices, directory listings and the footer of a newsletter from 2022.

For each address, write down four things:

• who can read it
• who can send as it or on behalf of it
• who can change its settings
• where it actually lives, whether that is Microsoft 365, Google Workspace, a hosting panel or a dusty IMAP account

Then ask the uncomfortable question: which of those people are still here? Contractors, former staff and the freelancer who set up the website are common ghosts in shared inboxes. If access is tied to a single password rather than named accounts, you cannot answer the question at all. That is the first finding of the audit.

The rules are the real back door

Phishing gets the headlines, but mail rules do the damage. Open the settings for each shared mailbox and look for forwarding rules, auto-forwarding to external addresses, rules that move messages into a folder marked 'Archive' or 'Receipts', and rules that mark things as read. Scammers love a rule that hides replies while the mailbox keeps working normally.

Check delegated access too. Who has 'send as' or 'send on behalf of' permission? Who can open the mailbox from their own account? Are there connected apps or OAuth grants that still have permission to read mail? A shared inbox with a forgotten app integration is a shared inbox with an extra front door.

While you are in there, inspect the recovery email address and recovery phone number. If they point to a personal account that left with a former employee, the next password reset could go somewhere you do not control. For UK teams, that is also a data protection headache waiting to happen, not just an IT tidy-up.

Test the front door like a scammer would

A shared inbox needs to be tested from the outside, because that is how the scam arrives. Send a plain test message from a personal address and see where it lands. Then try a message with a link, a PDF attachment and a display name that looks like a known supplier. Check whether the shared mailbox has been added to any trusted sender lists or transport rules that bypass spam filtering. Those exceptions are often added for a good reason and forgotten for a bad one.

Look at the quarantine and digest settings. If the shared inbox receives a daily summary, who reads it? If nobody does, the filter is doing half a job. Make sure at least one named person owns quarantine review, and that they know what a lookalike domain or a mismatched reply-to address looks like.

Outbound matters too. If the team sends quotations from info@, check that the domain has SPF, DKIM and DMARC set up properly and that 'send as' does not break alignment. A shared inbox that sends unauthenticated mail is a deliverability problem on a normal day and a spoofing problem on a bad one. The NCSC's guidance on email security is a sensible baseline here, and Cyber Essentials gives smaller teams a clear starting point.

Lock it down without breaking the team

The goal is not to make info@ hard to use. It is to make it hard to abuse. Move away from a shared password and use a proper shared mailbox with named user accounts. Every person should sign in as themselves, with multi-factor authentication enabled. If the platform supports it, use role-based access so that a temporary helper can read enquiries without also being able to change forwarding rules.

Block external auto-forwarding by default, or at least alert on it. Turn on notifications for new mailbox rules and permission changes. Remove stale delegates. Give the team a password manager so nobody is tempted to reuse the old shared password elsewhere. And make sure the mailbox has a recovery route tied to a role, not to one person's mobile phone.

The quarterly ten-minute review

Put a recurring calendar entry in place, ideally on a Friday when nobody is in a rush. Check the guest list, scan for new forwarding rules, confirm MFA is still on, review connected apps, and look at the junk folder for anything that should have been caught. If someone has left, remove their access the same week, not at the next audit.

Shared inboxes are not going anywhere. They are too useful. But useful is not the same as safe. Give info@ a name, a list of owners and a short set of rules, and it stops being a team-wide liability with a friendly email address.