Quote:

Before a vacation or business trip, many employees configure an autoreply to incoming e-mails so that clients and colleagues know who to contact in their absence. Usually such messages include the duration of the trip, contact details of cover staff, and sometimes information about current projects.

Autoreplies may seem harmless, but they can be a business risk. If an employee does not restrict the list of recipients, the autoreply will go to anyone whose e-mail ends up in the Inbox folder — and it could be a cybercriminal or spammer who has managed to bypass the filters. The information in the autoreply could even be enough to carry out a targeted attack.

One line, big trouble

In the case of spammers, the autoreply lets them know that the email address is valid and belongs to a specific person. It tells them the person’s first name, last name, and position. The signature often contains a phone number, too.

Spammers usually fire out messages to addresses from a huge database, which gradually becomes outdated and less effective. But when a real person is detected at the end of the line, the cybercriminals mark them as a viable target and start mailing much more often. They may even call. But that’s far from the worst of it.