A letter sent to the wrong Sarah
You need to send a client a letter confirming attendance for their employer, and a statement of fees for their insurer. You attach both to an email and type the first few letters of the name. The autocomplete picks a different Sarah. You notice a second after pressing send.
Even when it goes to the right person, the attachment now lives in their inbox indefinitely, possibly on a shared family computer, and in your sent folder too. You have no way to know if it was opened, and no way to take it back.
Why attachments are the default
Email is what everyone already has. It is quick, needs no setup and clients understand it. The risks are invisible until the day something goes wrong.
- Autocomplete makes misaddressed emails easy.
- Attachments are copies you can no longer control once sent.
- Client inboxes may be shared, or accessible to an employer.
- Your sent folder becomes an unplanned second store of client documents.
- No record of whether the client actually received or opened the document.
The cost when it goes wrong
| Situation | Consequence |
|---|---|
| Misaddressed email | A data incident you may need to record and possibly report |
| Document seen by someone else at home | A breach of the client's privacy |
| Copies in sent folders | More places to search and delete when retention applies |
| No proof of delivery | Uncertainty when a client says they never got it |
| Worry every time you press send | A small daily friction |
What must happen after a misaddressed email is for your own policy and adviser to guide. The practical fix is to make it much harder to happen, and much less serious if it does.
Secure sharing for client documents
- Documents stay in your practice system or a locked-down store in Microsoft 365 or Google Workspace.
- Clients get an email with a link, not the file. The email itself says nothing sensitive.
- Opening the link needs a second step: a one-time code sent to the client's phone, or a login to a small client portal if you want one.
- You see when the document was opened, and can withdraw access at any time, including straight away if a link went to the wrong person.
- Links expire after a period you choose, so documents do not sit open forever.
- Clients can upload documents back the same way, so returned forms land in the right client file.
Many practice systems include a client portal or secure messaging. If yours does, setting it up properly is usually the first thing we suggest.
For clients who find the extra step difficult, you can keep a plain email option on their record by agreement, so the secure route is the default rather than a barrier.
What changes
A misaddressed link becomes a moment's embarrassment rather than an incident: you withdraw it, and the wrong person never sees the file because they cannot pass the second step. Clients open documents when it suits them, and you can see that they did.
Your sent folder stops being a second filing cabinet, and retention only has to be applied in one place.
Is it time to change this?
- You send letters, statements or forms as email attachments.
- You have sent, or nearly sent, an email to the wrong client.
- Clients have mentioned sharing an inbox or computer.
- Your sent folder holds years of client documents.
- You cannot tell whether a client received a document.