# The Risks of Sharing a Common Mail Password | DBLinx > What are the risks of sharing a common mail password? Ways to manage shared addresses like info@ and accounting@ securely, without sharing a password. Source page: https://dblinx.net/en/rehberler/ortak-parola-riskleri --- Security # The risks of sharing a shared mail password: how to use info@ and accounting@ addresses safely? The biggest risk of sharing a shared mail password is not knowing who logged into the mailbox or who sent what. The more people a password circulates among, the higher the chance it leaks, a departing employee keeps accessing the mailbox, and everyone's work stops when the password changes. The solution is to use shared addresses with per-person permissions instead. 6 min readPublished: 24.09.2026Updated: 29.09.2026 ## Why is a shared password so common? info@, sales@, accounting@ addresses like this exist for work that more than one person needs to follow. The fastest fix is to tell the team the mailbox password and have everyone add it to their own mail app. It's easy to set up, needs no extra configuration, and seems to work fine in the early days. Problems surface over time: the team grows, employees change, and the password ends up shared a few times over messaging apps and email. At some point, it's no longer known how many people, or from which devices, have access to the mailbox. ## What are the risks of sharing a common mail password? - **Who did what becomes unclear.** When a wrong quote goes out to a customer, or an important email gets deleted, it's impossible to tell who did it; everyone signed in with the same identity. - **A departing employee keeps having access.** If the person who knows the password leaves the organization and the password isn't changed, they keep access to the mailbox. - **Changing the password stops everyone.** When the password changes, everyone using the mailbox has to get the new one and update it on every device; that's exactly why the password often never gets changed at all. - **The chance of the password leaking goes up.** A password sitting in a messaging app, a note file or a screenshot leaks far more easily than a person's own password. - **Two-step verification can't be applied.** The second step is tied to a single phone; on an account used by several people, that step either gets disabled or gets in everyone's way. - **Permissions can't be separated.** An intern who only needs to read the mailbox ends up with the same permission as the specialist replying on its behalf. ## What happens if the password leaks? Shared addresses are the organization's outward-facing surface; customers, suppliers and banks correspond with these addresses. A accounting@ address with a leaked password gives an attacker both past invoices and payment correspondence, and the ability to send mail from that address that looks trustworthy. Attacks like fake IBAN notices succeed most often with mail coming from exactly this kind of address. On top of that, because many people know the password, finding the source of a leak is nearly impossible. Since it's never known which device or which sharing it leaked from, the same problem can repeat itself. That's why, when a suspicious action is noticed in a mailbox used with a shared password, the only thing to be done is change the password, which again stops everyone's work and gives no information about where the problem came from. With per-person access, only the account in question is closed, and other employees carry on working. ## How can shared addresses be used without sharing a password? - **Have everyone sign in with their own identity.** Access to the shared mailbox should be a permission granted to a person's own account; the mailbox's password shouldn't be told to anyone. - **Separate permissions by task.** Actions like reading, replying and deleting should be granted as separate permissions. - **Tie access to the department.** The accounting mailbox should be assigned to the accounting department; when a person leaves the department, their access should lift automatically. - **Log actions.** Who read, sent or deleted which email should show up under the person's name. - **Plan the transition.** Once per-person access is set up, change the old shared password and don't share the new one with anyone. ## How is work divided in a shared mailbox? Once the password problem is solved, a second question comes up: two people replying to the same email, or a message going unanswered because everyone assumed someone else was handling it. For this, it helps for there to be a clear owner for mail in the shared mailbox, for a colleague's attention to be able to be drawn to a specific email, and for team-visible notes to be added to messages. These habits turn a shared address from an "everyone's and no one's" mailbox into a tool with clear team ownership. For the customer, the result is a faster and more consistent reply. ## Are these measures needed in a small team too? Sharing the password in a two- or three-person team may look harmless. But the risks don't depend on the team's size, they depend on how important the mailbox is. An accounting or sales address carries payment and customer information even at a small business. Setting up per-person access while the team is still small is far easier than untangling a messy setup after it's grown. ## How do you move from a shared password to per-person access? - List everyone who uses the shared mailbox and what actions they take. - Decide the permission each person needs: who only reads, who replies, who deletes. - Define per-person access and confirm everyone can reach the mailbox with their own account. - Remove any old shared-password entries saved in mail apps and on phones. - Finally, change the mailbox password and don't share the new one with anyone. The transition can be completed within a week. Briefly explaining to the team why the change is being made makes it easier for everyone to adopt the new setup. ## Is keeping the shared password in a password manager enough? A password manager keeps the password from circulating through messaging apps, and in that respect it's an improvement. But since everyone still signs in with the same identity, who did what still can't be told apart, permissions still can't be separated, and closing off a departing person's access still requires changing everyone's password. The lasting fix is to never give the password to people at all. ## How does SmartMail open shared mailboxes without sharing a password? - **No password is handed out:** Users access shared mailboxes with their own identity (SmartID). The system generates the mailbox's password and keeps it encrypted; only an administrator can see it, and every view is logged. - **Nine permissions per mailbox:** Viewing, writing and sending, deleting, labeling, quarantine, AI re-interpretation, AI chat, notes and flagging-for-attention are each granted separately. - **Assignment board:** Shared mailboxes are assigned to people or department cards by drag-and-drop; when a person leaves a department, their access is revoked automatically. - **Logged under the person's name:** The audit log in the admin screen shows actions under the name of the person who performed them. [SmartMail shared mailboxes](https://dblinx.net/en/smartmail/paylasimli-kutu.html)[Granting product access](https://dblinx.net/en/belgeler/baslarken/urun-erisimi-verme) ## Frequently asked questions What if we never change the shared mailbox's password? Anyone who's learned the password once can keep accessing the mailbox, even after leaving the organization. This risk disappears once access is switched to a per-person basis. Can we see what everyone does in the shared mailbox? Yes, when everyone signs in with their own identity; actions are logged under the person's name. When everyone signs in with the shared password, this distinction can't be made. How is two-step verification applied to shared addresses? When a person accesses the shared mailbox through their own account, two-step verification is applied on that person's own account too. Can customers see who's handling the shared mailbox? No. The customer only sees the shared address; the reply still goes out from info@ or sales@. Per-person access only makes it visible inside the organization who did what; from the outside, the correspondence looks the same. Can we give an intern read-only access to the shared mailbox? Yes, in a system where permissions are granted separately per mailbox; viewing is granted, sending and deleting are not. ## Use shared addresses without a password In SmartMail, the team accesses shared mailboxes with their own identity; each person is granted only as much permission as their job needs. [Request a quote](https://dblinx.net/en/teklif-iste)[Get in touch](https://dblinx.net/en/iletisim) ## Other guides - [SecurityWhat is CEO fraud? A guide to protecting against fake IBAN emailsCEO fraud is an email scam in which an attacker posing as an executive or supplier convinces an employee to make an urgent payment or pay a fake IBAN. The attacker wants the payment redirected to another account. These emails often carry no malicious link or attachment, so they easily pass through standard spam filters.6 min read](https://dblinx.net/en/rehberler/ceo-dolandiriciligi-sahte-iban) - [SecurityHow to spot a fake invoice email: a checklist for accounting teamsA fake invoice email is identified by checking the sender address, attachment, amount and bank details against independent records. These emails appear to come from a genuine supplier and report an unpaid invoice or changed payment details. The goal is to redirect the payment to the attacker's account or get the malicious attachment opened.6 min read](https://dblinx.net/en/rehberler/sahte-fatura-mailleri) - [SecurityWhat are SPF, DKIM and DMARC? An email authentication guide for administratorsSPF, DKIM and DMARC are three DNS records that verify that emails sent on behalf of a domain actually come from that domain's owner. SPF defines the authorized servers, DKIM confirms the email wasn't altered, and DMARC determines what happens to mail that fails the check. Set up together, they make your domain much harder to impersonate.6 min read](https://dblinx.net/en/rehberler/spf-dkim-dmarc-rehberi)