How Do I Set an Out of Office That Does Not Tell Scammers I Am Away?

Use the Outlook option that sends one reply to people inside your business and a different, much shorter reply to everyone outside it. Give your colleagues the full detail. Give the outside world almost nothing, just that you are away with limited access to email and that urgent matters can go to the office. The same detail that helps your team is a gift to a scammer.

Why an automatic reply is a problem

A typical out of office names who is away, says exactly when they are back, names the person covering and gives their direct email, and often ends with a mobile number. Now imagine a scammer reading it.

They know the owner or finance person is unreachable for a week. They know who is covering and that this person is probably busy and unfamiliar with the usual suppliers. This is exactly how a payment redirection scam works. A convincing email arrives that appears to come from the absent manager or a regular supplier, asking for an invoice to be paid to new bank details, and the person covering has no easy way to check. Scammers send to many addresses at once so the automatic replies tell them who is away.

What to check first

Look at the last out of office you used and ask yourself four things.

1. Did it say when I would be back?
2. Did it name the person covering and give their direct email?
3. Did it include a mobile number?
4. Was it the same message for everyone, inside and outside the business?

If the answer to any of those is yes, it gave away more than it needed to.

Set two different replies

Outlook lets you write separate messages for inside and outside your organisation, and you can turn the outside one off altogether. This is the most useful setting here.

For people inside the business, write whatever your team needs. Dates, who is covering, and how to reach you if something cannot wait.

For people outside the business, keep it short and vague. Something like this is enough.

Thank you for your email. I am out of the office with limited access to email and will reply on my return. For urgent matters please call the office.

Notice what is missing. No return date, no covering person, no direct email and no mobile number. A genuine customer loses nothing, because the office can still help them. A scammer learns nothing they can use. For many small businesses, no external reply at all is the right answer.

Other things to avoid

Do not set automatic replies on shared mailboxes such as accounts or info addresses. Those are the first place a fake invoice lands, and an automatic reply confirms the address is live and names who is watching it.

Be extra careful around holidays. The weeks when half the office is away are peak season for fake invoice and changed bank details scams, because scammers know approvals are rushed. Any request to change payment details while someone is on leave should wait until they are back, or be confirmed by phone on a number you already hold.

What to do next

The step by step for separate inside and outside replies is in our guide to setting up out of office replies in Outlook. How well your business would stand up to a payment redirection attempt is part of what we look at in a cyber security review.

Will customers be annoyed by a vague reply?
No. They learn you are away and how to reach the office, which is all they need. Nobody needs your return date to get help.

Can I set the two replies on my phone?
Yes. The Outlook app has the same inside and outside options, and they apply wherever you read your mail.

What if I use a shared mailbox for a small team?
Leave the automatic reply off and have one person check it each day. If the mailbox must announce an absence, do it only to people inside the business.

If this is happening in your business and you would like it sorted, call DM1 on (08) 6202 6012 or send us a message. We look after IT, Microsoft 365, websites and domain names for Perth small businesses.