Your Away Message Is a Free Org Chart — Here's the Fifteen-Minute Fix
Set an out-of-office for a week in Portugal and you've done two things at once. You've told your colleagues how to reach you, and you've told a stranger how to reach them. The first is good manners. The second is free reconnaissance.
Small UK teams feel this more than most. There's no comms team to rewrite the wording, no security desk to flag the smart-looking invoice that lands while you're on a train. The auto-reply is often written in a hurry on a Friday afternoon, and it stays up for a fortnight doing quiet work on your behalf.
This isn't about going silent. A good away message keeps the wheels turning. It just doesn't need to publish your diary and your deputy's mobile number.
What the reply is actually telling people
Read your current auto-reply as if you were a fraudster with a Companies House account and twenty minutes to spare. Dates and locations: 'I'm away until 21 November' is a travel schedule. If it says 'in Lisbon for a conference', that's a plausible reason to be unreachable and a clue about the time zone. Cover contact: 'Please contact Dave on 07700 900123' is a named person, a direct line, and a social-engineering script. 'Dave will be handling urgent payments' is better still — it tells the attacker which lever to pull. Urgency language: 'I'll have limited access to email' invites a fake invoice with a tight deadline. Role details: job title plus approval limits plus team structure is an org chart with a bow on it.
The three leaks most teams forget
Email gets all the attention, but the same story is often sitting in two other places. Your voicemail greeting is a recording of the same facts, sometimes with more detail. Your shared calendar may show 'Out of office — Berlin' on a public or company-wide view. And your chat status, reception whiteboard, or website team page can fill in the rest. A common version of this: the calendar entry says 'Annual leave — cover: finance@' while the auto-reply names a different person entirely. Two versions of the truth is worse than one.
A fifteen-minute audit you can run today
-
Send yourself a test. Use a personal address or a colleague's external account. Read the reply as a stranger. Highlight any dates, names, mobile numbers, locations, approval references, or 'no access' phrases.
-
Check the calendar. Open sharing settings and see what an outsider or all-staff view shows. Change 'Out of office' entries to 'Away' without location. If you need dates for internal planning, keep them on the internal calendar only.
-
Dial your own voicemail from a mobile. Does it name dates, a mobile, or a person? Re-record it. The same rules apply: role-based contact, no travel detail, no 'call my mobile if it's urgent'.
-
Look at the website and LinkedIn. If your team page says 'Priya — Finance Manager' and the auto-reply says 'contact Priya', that's a joined-up target list. You don't need to delete the team page, just don't pair it with a live handover that tells a stranger exactly who to call and when.
-
Ask the cover person what they've been told. Do they know they're named? Do they know what a genuine urgent request looks like? A two-minute chat closes the loop. If they didn't know they were the named contact, that's the finding.
Templates that keep the handover, drop the intelligence
The principles are simple. Use role-based contacts, not personal mobiles. Say when you're back without announcing where you are. Give the cover person a process, not just a name. Keep the sensitive handover in an internal note, not in a message that goes to anyone who emails you.
Standard external auto-reply
Thank you for your email. I'm away from the office at the moment and will pick up messages on my return. For anything that can't wait, please email [team inbox] and a colleague will respond. Best wishes, [Name].
Finance or approvals role
Thanks for your message. I'm currently away. Invoices and payment requests should go to [accounts inbox] where they'll be reviewed in the usual way. Please don't send payment changes to my personal address. [Name].
Voicemail greeting
Hello, you've reached [Name] at [Organisation]. I'm away from my desk at the moment. Please email [team inbox] or call the main office on [number] and a colleague will help. Thank you.
Shared calendar entry
Away — contact [team inbox] for anything urgent. No location, no 'flying to Dublin', no hotel name.
Internal handover note — not the auto-reply
Cover for [Name], [dates]. Live issues: [list]. Approval limits: [details]. Who to escalate to: [name and number]. Known scams doing the rounds this month: [brief note]. This is the document that actually helps your team. The auto-reply just needs to route the enquiry.
The cover contact is now a target
If your auto-reply names Dave, Dave is now part of the attack surface. He may get a call: 'Hi Dave, [Name] said you'd handle this while they're away — can you approve this payment?' That's not a sophisticated hack. It's a plausible sentence. Brief your cover contact before you go. Agree how urgent payments will be verified: a callback to a known number, a second approver, a shared inbox rather than a personal one. In very small teams, a generic office@ address and the main switchboard number are often enough.
Put the message on your pre-holiday checklist
Before you switch the auto-reply on, run the five checks above and use the templates as a starting point. Then add three lines to your pre-holiday routine: update the away message, update the voicemail, and tell the cover contact they're named. It takes less time than writing the message in the first place.
The NCSC's phishing and business email compromise guidance is free, short, and worth a skim before you travel. Action Fraud is the place to report a suspected scam, and Companies House will tell you who's who at a company in seconds. Attackers use that same public information. Your away message doesn't need to add to it.
A useful handover is not the same as a public itinerary. Keep the message short, keep the contact role-based, and keep the details for the people who actually need them.
