A confidential email lands in your inbox by mistake. See the right order of steps to take, when to escalate to security, and what not to do next.
If a confidential email lands in your inbox by mistake, do not forward, screenshot, or act on it beyond confirming it was misdirected. Reply to the sender to flag the error, and if the content involves personal data, financial information, or anything sensitive, report it to your security or compliance team rather than deciding on your own that no harm was done.
Most guidance on email mistakes focuses on the person who sent it. The recipient’s side gets far less attention, which is strange, because misdirected email is one of the most commonly reported data security incidents regulators track, and every one of those incidents has a recipient making a decision that determines what happens next: read further, forward it, screenshot it, mention it to a colleague, or report it and move on. That decision determines whether a misdirected email stays a minor slip or becomes a second incident layered on top of the first one.
Organizations that only train the sending half of this problem, covered in what to do about misdirected email you send, miss half the risk. A well-trained employee who never misdirects a message can still turn someone else’s mistake into a real breach by handling a wrongly received email carelessly.
Before doing anything else with a misdirected email, answer three questions in order.
Is it spam or a mass send. If the message is a marketing blast, a newsletter, or clearly automated and contains nothing personal, delete it or mark it as junk and move on. No response is required.
Do you know who it was actually meant for. A message with a similar name in the “to” field, an internal typo, or an obvious autocomplete error usually makes the intended recipient clear.
Is the content sensitive. Personal data, financial details, health information, legal correspondence, or anything under a confidentiality agreement changes everything that follows, regardless of how you answered the first two questions.
Discover how Threatcop protects your workforce from modern cyber threats.
If it is obvious who the confidential email was meant for and the content is not sensitive, forward it to that person and copy the original sender so they know what happened. This closes the loop without you reading further than necessary or holding onto information that was never meant for you.
If the content is sensitive, do not forward it, even to the right person, without checking with your security team first. Forwarding sensitive data introduces a second point of exposure and a second person now holding data outside its intended boundary. Let the original sender resend it through the correct, secure channel instead.
If there is no way to tell who a misdirected email was intended for, reply to the sender, explain that you received it by mistake, and ask what they would like you to do. Do not guess and forward it to someone who seems like a plausible match. A wrong guess compounds the original mistake with a second misdirected send, except this time you are the one responsible for it.
If the sender is unreachable, or the message came from outside your organization and appears to involve something urgent to someone’s safety, career, or finances, that is the point to escalate to your security or compliance team rather than deciding alone how much effort the situation deserves.
Escalate rather than resolve it quietly whenever any of the following is true, the same threshold used for information security risk management generally: the email contains personal data about people who are not you, it involves financial account details or credentials, it came from outside the organization and you cannot verify who sent it, or you are genuinely unsure whether it counts as confidential business information. Uncertainty is itself a reason to escalate, not a reason to assume it is probably fine.
This is the same judgment call organizations ask employees to make when they report a phishing attempt rather than deleting a suspicious email and saying nothing. A misdirected email you received is not an attack, but the reporting instinct that catches one also catches the other, and building one habit tends to build both.
In most jurisdictions, receiving a misdirected email by accident carries no legal obligation to act, and forwarding or discussing it is not automatically unlawful the way, for example, accessing a system without authorization under laws like the Computer Fraud and Abuse Act would be. But a confidentiality agreement your organization has with a client or partner can create an obligation your personal legal exposure would not, which is exactly why this is a security and compliance question, not a purely ethical one you resolve on your own.
This is the human side of why human error contributes to security risk: the mistake already happened, and what you do next either contains it or compounds it. Treat gossiping about the contents, or mentioning what you saw to a colleague who was not on the message, as off the table regardless of the legal position. The content was never meant for you to have an opinion about, and repeating it does the same harm as forwarding it would.
The gap in most training programs is that they cover sending mistakes and phishing recognition but never address what a recipient should do with someone else’s misdirected data, even though Verizon’s Data Breach Investigations Report tracks this exact failure mode every year under its Miscellaneous Errors pattern. That is a real gap, because how incident reporting culture prevents greater damage depends on every employee knowing what counts as reportable, not just the employees who happen to make the original mistake.
Closing that gap looks like two things done together, not one alone.
| Element | What it covers | Why it matters here |
|---|---|---|
| Explicit recipient-side guidance in training | What to do when you receive, not just when you send, a misdirected message | Most programs are entirely sender-focused and leave this scenario untrained |
| A low-friction reporting channel | A named, fast way to flag a received-in-error message without a formal process | Removes the hesitation that turns a five-minute report into a held-onto secret |
Role-based training is where this gets built. Threatcop’s TLMS delivers this kind of scenario-specific microlearning as a short refresher rather than folding it into a once-a-year module that people forget within weeks, which matters because recipient-side judgment calls like this one come up rarely enough that nobody remembers the right answer without recent reinforcement.
Every misdirected email has two people who can contain it or make it worse: the person who sent it and the person who received it. Most training only prepares the first person. Building the same instinct into the second, report what looks sensitive, do not forward or repeat it, and let security make the call when you are unsure, closes a gap that otherwise sits open in plain sight. See how scenario-specific training builds that instinct on Threatcop’s security awareness training platform.
Generally no, simply reading a misdirected email that landed in your own inbox is not illegal in most jurisdictions, since you did not access anything without authorization. What you do next, such as forwarding, screenshotting, or acting on the content, is where legal and organizational risk actually starts.
Yes, if the content is sensitive or you are unsure. Reporting a confidential email you received by mistake protects you as much as it protects the organization, and it lets security assess whether the sender’s mistake needs to be addressed more broadly.
Reply to the external sender to flag the mistake if you can verify who they are, and loop in your own security team regardless, since an external misdirected email might indicate a vendor or partner with weaker data handling practices than your own organization expects.
Forwarding a non-sensitive email to the person it was clearly meant for, while copying the original sender, is standard practice and not something you would be penalized for. The risk appears when the content is sensitive and forwarding it, even to the correct person, adds another party who now holds data that should have stayed contained.
Do not keep it longer than it takes to report or resolve it. Once you have flagged it to the sender or your security team, delete it rather than archiving it indefinitely, since retaining someone else’s sensitive data for your own records serves no purpose and extends the exposure window.
Praveen Pal Singh is the Growth Director – North India & ASEAN at Threatcop, with experience spanning cybersecurity, business growth, and People Security Management. He works with organizations to address human-layer risks and strengthen their cybersecurity resilience. His areas of expertise include cybersecurity awareness, social engineering, phishing, email security, human risk management, and People Security Management. He is passionate about helping organizations build stronger, people-centric defenses against evolving cyber threats.
AI-written phishing has no typos left to catch. See why manufactured urgency is now the most reliable red flag,...
Will AI replace security researchers? Mythos-class models find vulnerabilities faster, but verification, triage, and initial access still need humans.
Mean time to patch explained: what MTTP measures, why the median has risen to 43 days, and how to...
