What Does Your "Out of Office" Message Tell Attackers?
In this article
Seen through an attacker's eyes, the "out of office" message you set before a holiday is an intelligence package you hand over yourself. It usually says how long you will be away, who is covering for you, and that person's email and phone number. Social engineering attacks are built on exactly this kind of information. In this article we explain how auto-replies are exploited and how to write a safer message.
What does an auto-reply tell an attacker?
A typical auto-reply includes:
- How long you will be unreachable
- Who is covering for you
- That person's name, job title, email address and phone number
- Sometimes where you are ("I'm abroad", "I'm at a trade fair")
The auto-reply is also sent to any email from outside the organisation. So all an attacker has to do to get this information is send you an email.
What does the attacker do with it?
Social engineering attacks rely on timing and context. An attacker who knows you are away can send your stand-in an urgent request in your name. "John is on holiday, you need to approve this payment on his behalf" is surprisingly convincing when it arrives at the right moment.
If your deputy's name, email and phone number are in the message too, your auto-reply completes the attacker's reconnaissance. This information is used especially in executive impersonation and CEO fraud scenarios: the executive is unreachable, the deputy cannot verify the request, and the pressure of urgency kicks in.
A safer "out of office" message
Share your stand-in's contact details directly with the people you work with, and leave them out of the auto-reply. In the external reply, write only:
"I have limited access to email. For urgent matters, please call the office."
This small change keeps your internal workflow intact while keeping the information that leaks outside to a minimum.
Extra measures for organisations
- Separate internal and external replies. Many email systems let you set different auto-replies for inside and outside the organisation. Detailed information can go in the internal reply only.
- Clarify delegation processes. If a payment or access request arrives on behalf of an absent executive, verification through a second channel should be mandatory.
- Inform employees. The "your manager is on holiday, we need urgent approval" pattern should feature in awareness training and phishing simulations.
Security culture is built from small habits like these.
Frequently asked questions
Should we stop using auto-replies altogether?
No. Auto-replies are useful for business communication. What matters is leaving unnecessary detail out of the external reply.
Why is naming a deputy in the external reply risky?
It tells the attacker whom to target and in whose name to speak. This shortens the preparation phase of targeted phishing and executive impersonation attacks.
Can auto-replies to external senders be turned off?
Systems such as Microsoft 365 and Google Workspace let you send auto-replies only inside the organisation or only to people in your contacts. The IT team can also configure these settings as the default.
---
InfoLore's awareness programmes cover everyday habits like these and social engineering scenarios. Get in touch to design a programme for your team.
Related articles
Runs the full cycle of awareness programmes, from needs analysis to impact reporting. Worked in cybersecurity channel management and consulting at Elcore Group and Digital Deals, after more than fifteen years at Turkcell and Türk Telekom. Author of "Outrun the Lion", a book on human error in cybersecurity.