How a Forgotten Email Address Can Hand Over the Keys to Your Business

Published by Aqib Muhammed, CEO

Somewhere in your business, there is an inbox nobody has opened in years. Maybe it belonged to a salesperson who left years back. Maybe it sits on the old domain you used before the rebrand. It still gets mail. Last night, that may have included a password reset link for your company's cloud storage.

Nobody at your business saw it. You can't be sure nobody else did.

That is the quiet risk of a forgotten email address. Most online services let people back in through email, so whoever controls an old inbox can walk through doors you thought were shut. It's a security risk for your business.

What counts as a forgotten email address in a business?

A forgotten email address is any address linked to your business that still exists or could be brought back, but that nobody checks or controls. Most businesses have several and they fall into three types.

Type	Typical example
Leaver and role inboxes on your own domain	A former employee's address or an old sales@ or careers@
Addresses on a domain you no longer use	An old brand, a pre-rebrand domain or an acquired company's domain
Your details on services you stopped using	A free trial, an old supplier portal or an ad account opened with a personal address

The third type is the hardest to see. They live on someone else's website, so no internal list shows them. They are known as ghost accounts, old logins still tied to an email address, sitting unused until someone finds them.

How can a forgotten email address be used to take over your accounts?

Through the "Forgot password?" button.

Most services send a reset link to the email address on the account, so whoever controls that inbox can set a new password and sign in as you, without ever knowing the old one. This is called account takeover.

One forgotten inbox can receive the reset links for every account registered to it.

Someone gains control of "ops@oldbrand.example.com", using a password reused from an old data breach or by registering the lapsed domain.
They visit a service tied to that address and click "Forgot password?".
The password reset link lands in the forgotten inbox.
They set a new password, swap in their own recovery details and lock your team out.

It spreads because old addresses are commonly the recovery address on newer accounts: the backup email a service uses to let you back in. If a forgotten inbox recovers your main business email, one weak spot opens the account that resets everything else.

The good news: Two-factor authentication (2FA) on the service stops most of these resets, because a reset link alone is not enough to get in. Many old accounts never had it switched on.

What can a hacker do with an old business email account?

Borrow the trust it has built up. An old business inbox comes with a real name, real past conversations and real contacts, so a fake message sent from it looks genuine.

What is in the old inbox	How it gets misused
Past threads with customers and vendors	A reply inside an existing conversation, asking for a payment or a login (impersonation and phishing)
Invoices, quotes and supplier bank details	A believable "our bank details have changed" email that sends a real payment to the wrong account
Contracts, ID copies and receipts	Material for scams tailored to your staff and clients or sold on

The scam works because the email really comes from your business. That also means the blame lands on your name, even though someone else pressed send. If this has already happened, here is what to do when an employee’s email account is hacked.

What happens to your email when your domain expires?

First, email sent to the domain stops arriving. Then, once the registrar's grace period ends, the domain goes back on sale. Whoever buys it can create any address on it, including the ones your old accounts still use and receive the mail sent there.

A catch-all mailbox makes this easy; one inbox that accepts mail sent to any name on the domain. Every reset link, client email and service alert still heading to your old domain lands there.

By the numbers: Infoblox Threat Intel observed around 65,000 expired domains being re-registered every day in the first half of 2026, nearly one in five new domains. Most are not malicious, but the scale shows how quickly a lapsed name finds a new owner.

Registrars send renewal reminders to the contact email on the account. When those reminders go to an old or unchecked address, nobody acts on them and registrars themselves name this as a common reason domains lapse. So the forgotten address can be what lets the domain expire.

How a forgotten contact address can cause the domain expiry that makes it dangerous

How do forgotten email addresses cost you customers?

Quietly. An enquiry sent to an address nobody reads goes unanswered and the sender assumes you are not interested. Alerts and codes sent there go missing too.

A customer replies to an old quote that came from a leaver's address.
A payment provider sends a warning about your account and nobody sees it.
A one-time login code goes to a mailbox no one can open and your team is locked out.

How to find and secure the forgotten email addresses in your business

List every address, decide what each one should be and lock down the ones you keep. The first pass takes an afternoon. After that, it is a habit.

List every address. Include current staff, leavers, role addresses (info@, sales@, billing@), every domain the business has ever owned and the services where your details still sit. See how attackers find employee email addresses.
Map your recovery addresses. For your domain registrar, bank, cloud storage, accounting and payment accounts, check which email recovers each one. Change any that point to a forgotten address.
Switch on two-factor authentication (2FA) for every address you keep. Use an authenticator app or a security key where the service allows it, not SMS codes alone.
Run the business on a domain you own. Keep important accounts on your own domain, not a free consumer address or one tied to an internet provider, so control stays with the business when people or providers change.
Keep that domain renewed. Turn on auto-renew, set the renewal contact to a shared address that several people read and keep old domains that once carried email.
Close the door on leavers. As part of offboarding, block sign-in on their last day, reset the password, set an auto-reply pointing to a current contact and move their logins to a shared address. Remove the mailbox only once nothing depends on it.

The six steps cover the addresses you can see, but Ghost accounts are harder to spot, because they sit on other companies’ websites and never show up in your own systems.

Shield by Synctric is built for that gap. Add the addresses from your list, including leaver and role inboxes and Shield surfaces old logins still tied to each one. It also alerts you if any of those addresses turns up in a known data breach. Businesses with many addresses can add them in bulk and group them by department.

The result is a short, clear list of which forgotten addresses need attention first, so the clean-up starts in the right place.

Frequently Asked Questions

Do unused email accounts get deleted automatically?

Personal ones can be. Google may delete a personal account unused for two years and Microsoft can close personal accounts with no sign-in for two years. Google's policy does not cover accounts set up by an organisation, so business mailboxes usually stay until an admin removes them.

Can someone else take over an old email address once it is closed?

It depends on who controls the domain. Gmail does not reissue a deleted address, while some other providers release closed addresses after a holding period. On your own domain, anyone who later owns the domain can recreate any address on it.

Can you get an expired domain back?

Usually, if you act fast. Registrars typically hold an expired domain through a grace period, then a pricier redemption period, before releasing it. Lengths vary, so contact your registrar the day you notice.

Should you delete old email accounts or keep them?

Move every login off it first, because deleting early can lock you out. On your own domain, then block sign-in and keep the address as a watched alias. A free or internet-provider address can then be closed or kept locked with a strong password and 2FA.

How do you find every account linked to an old email address?

Search the inbox for "welcome", "verify your email" and "receipt". Then check connected apps in your Google or Microsoft security settings, saved passwords in your browser or password manager and card statements for subscriptions.

When should a business check for forgotten email addresses?

At least once a year and every time someone leaves, a domain comes up for renewal or you switch email provider. Those are the moments addresses slip out of sight, so checking then catches most of them.