The risks of sharing a shared mail password: how to use info@ and accounting@ addresses safely?
The biggest risk of sharing a shared mail password is not knowing who logged into the mailbox or who sent what. The more people a password circulates among, the higher the chance it leaks, a departing employee keeps accessing the mailbox, and everyone's work stops when the password changes. The solution is to use shared addresses with per-person permissions instead.
Why is a shared password so common?
info@, sales@, accounting@ addresses like this exist for work that more than one person needs to follow. The fastest fix is to tell the team the mailbox password and have everyone add it to their own mail app. It's easy to set up, needs no extra configuration, and seems to work fine in the early days.
Problems surface over time: the team grows, employees change, and the password ends up shared a few times over messaging apps and email. At some point, it's no longer known how many people, or from which devices, have access to the mailbox.
What are the risks of sharing a common mail password?
- Who did what becomes unclear. When a wrong quote goes out to a customer, or an important email gets deleted, it's impossible to tell who did it; everyone signed in with the same identity.
- A departing employee keeps having access. If the person who knows the password leaves the organization and the password isn't changed, they keep access to the mailbox.
- Changing the password stops everyone. When the password changes, everyone using the mailbox has to get the new one and update it on every device; that's exactly why the password often never gets changed at all.
- The chance of the password leaking goes up. A password sitting in a messaging app, a note file or a screenshot leaks far more easily than a person's own password.
- Two-step verification can't be applied. The second step is tied to a single phone; on an account used by several people, that step either gets disabled or gets in everyone's way.
- Permissions can't be separated. An intern who only needs to read the mailbox ends up with the same permission as the specialist replying on its behalf.
What happens if the password leaks?
Shared addresses are the organization's outward-facing surface; customers, suppliers and banks correspond with these addresses. A accounting@ address with a leaked password gives an attacker both past invoices and payment correspondence, and the ability to send mail from that address that looks trustworthy. Attacks like fake IBAN notices succeed most often with mail coming from exactly this kind of address.
On top of that, because many people know the password, finding the source of a leak is nearly impossible. Since it's never known which device or which sharing it leaked from, the same problem can repeat itself.
That's why, when a suspicious action is noticed in a mailbox used with a shared password, the only thing to be done is change the password, which again stops everyone's work and gives no information about where the problem came from. With per-person access, only the account in question is closed, and other employees carry on working.
How can shared addresses be used without sharing a password?
- Have everyone sign in with their own identity. Access to the shared mailbox should be a permission granted to a person's own account; the mailbox's password shouldn't be told to anyone.
- Separate permissions by task. Actions like reading, replying and deleting should be granted as separate permissions.
- Tie access to the department. The accounting mailbox should be assigned to the accounting department; when a person leaves the department, their access should lift automatically.
- Log actions. Who read, sent or deleted which email should show up under the person's name.
- Plan the transition. Once per-person access is set up, change the old shared password and don't share the new one with anyone.
How is work divided in a shared mailbox?
Once the password problem is solved, a second question comes up: two people replying to the same email, or a message going unanswered because everyone assumed someone else was handling it. For this, it helps for there to be a clear owner for mail in the shared mailbox, for a colleague's attention to be able to be drawn to a specific email, and for team-visible notes to be added to messages.
These habits turn a shared address from an "everyone's and no one's" mailbox into a tool with clear team ownership. For the customer, the result is a faster and more consistent reply.
Are these measures needed in a small team too?
Sharing the password in a two- or three-person team may look harmless. But the risks don't depend on the team's size, they depend on how important the mailbox is. An accounting or sales address carries payment and customer information even at a small business. Setting up per-person access while the team is still small is far easier than untangling a messy setup after it's grown.
How do you move from a shared password to per-person access?
- List everyone who uses the shared mailbox and what actions they take.
- Decide the permission each person needs: who only reads, who replies, who deletes.
- Define per-person access and confirm everyone can reach the mailbox with their own account.
- Remove any old shared-password entries saved in mail apps and on phones.
- Finally, change the mailbox password and don't share the new one with anyone.
The transition can be completed within a week. Briefly explaining to the team why the change is being made makes it easier for everyone to adopt the new setup.
Is keeping the shared password in a password manager enough?
A password manager keeps the password from circulating through messaging apps, and in that respect it's an improvement. But since everyone still signs in with the same identity, who did what still can't be told apart, permissions still can't be separated, and closing off a departing person's access still requires changing everyone's password. The lasting fix is to never give the password to people at all.
How does SmartMail open shared mailboxes without sharing a password?
- No password is handed out: Users access shared mailboxes with their own identity (SmartID). The system generates the mailbox's password and keeps it encrypted; only an administrator can see it, and every view is logged.
- Nine permissions per mailbox: Viewing, writing and sending, deleting, labeling, quarantine, AI re-interpretation, AI chat, notes and flagging-for-attention are each granted separately.
- Assignment board: Shared mailboxes are assigned to people or department cards by drag-and-drop; when a person leaves a department, their access is revoked automatically.
- Logged under the person's name: The audit log in the admin screen shows actions under the name of the person who performed them.