Major risks of sharing email accounts

DMARC monitoring should be as routine as checking your inbox, says Adam Lundrigan, CTO of DuoCircle. The aggregate reports tell you exactly who sends email from your domain. If you’re not reading them, you’re flying blind on your own email security posture.

The three core email authentication standards - SPF (RFC 7208), DKIM (RFC 6376), and DMARC (RFC 7489) - work together to verify that an email genuinely originates from the domain it claims to represent. DMARC Report

Major risks of sharing email accounts

					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						

Play Episode

					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						

Pause Episode

					</button>
					


				

				

					<audio preload="none" class="clip clip-23554">
						<source src="https://media.mailhop.org/dmarcreport/images/2025/04/Major-risks-of-sharing-email-accounts.mp3">
					</audio>
					

						

					

					

						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								

Mute/Unmute Episode

							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								

Rewind 10 Seconds

							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								

Fast Forward 30 seconds

							</button>
						

						

							<time class="ssp-timer">00:00</time>
							

/

							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H2M10S">2:10</time>
						

					

				

			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-23554" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-23554" title="Share">Share</button>
										</nav>
						

	



		

						

				

					

					

				

				

					

																																																																								

					

						

RSS Feed

							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-23554" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-23554" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

				

			

									

				

					

					

				

				

					

						Share						

					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/major-risks-of-sharing-email-accounts/&t=Major risks of sharing email accounts" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/major-risks-of-sharing-email-accounts/&url=Major risks of sharing email accounts" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2025/04/Major-risks-of-sharing-email-accounts.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

				

				

					

						Link						

					

						<input value="https://dmarcreport.com/blog/podcast/major-risks-of-sharing-email-accounts/" class="input-link input-link-23554" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-23554" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
				

				

					

						Embed						

					

						<input type="text" value='<blockquote class="wp-embedded-content" data-secret="YGPuRZaJvB"><a href="https://dmarcreport.com/blog/podcast/major-risks-of-sharing-email-accounts/">Major risks of sharing email accounts</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://dmarcreport.com/blog/podcast/major-risks-of-sharing-email-accounts/embed/#?secret=YGPuRZaJvB" width="500" height="350" title=""Major risks of sharing email accounts" - DMARC Report" data-secret="YGPuRZaJvB" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script>

/*! This file is auto-generated / !function(d,l){“use strict”;l.querySelector&&d.addEventListener&&“undefined”!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll(‘iframe[data-secret=”‘+t.secret+’”]’),o=l.querySelectorAll(‘blockquote[data-secret=”‘+t.secret+’”]’),c=new RegExp(“^https?:$”,“i”),i=0;i<o.length;i++)o[i].style.display=“none”;for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(“style”),“height”===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):“link”===t.message&&(r=new URL(s.getAttribute(“src”)),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(“message”,d.wp.receiveEmbedMessage,!1),l.addEventListener(“DOMContentLoaded”,function(){for(var e,t,s=l.querySelectorAll(“iframe.wp-embedded-content”),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(“data-secret”))||(t=Math.random().toString(36).substring(2,12),e.src+=”#?secret=“+t,e.setAttribute(“data-secret”,t)),e.contentWindow.postMessage({message:“ready”,secret:t},"")},!1)))}(window,document); //# sourceURL=https://dmarcreport.com/wp-includes/js/wp-embed.min.js ’ title=“Embed Code” class=“input-embed input-embed-23554” readonly/>

					<button class="copy-embed copy-embed-23554" title="Copy Embed Code" aria-label="Copy Embed Code"></button>
				

			

				

While sharing email accounts is convenient, users often do not consider the cybersecurity and **legal risks they pose. While your company might have convincing reasons to share email addresses, this practice should be avoided as much as possible.

If we go by definition, a shared email account is one that multiple people can access and use, usually within an organization or team. It’s mostly used to **manage communication where multiple people of a group have to come along for operations, for example, in customer support, sales, or info-based queries. Because of the ease with which shared accounts offer centralized communication, it has become a common workplace practice .

If these accounts are not managed properly, the organization can be left vulnerable to various kinds of cyberattacks. If any malicious activity (for example, sending phishing emails) is done through the shared account, it is difficult to identify the responsible person because of the absence of individual logs. There are more such risks that we’ll discuss in this blog.

Why does email security matter?

Email is one of the primary sources of communication in most organizations. We share so many **confidential details and files via emails that it’s also one of the most vulnerable assets. Email vulnerability isn’t just limited to data theft but also poses a threat of someone sending phishing emails on your behalf.

As of 2025, DMARC is mandatory under multiple compliance frameworks. CISA BOD 18-01 requires p=reject for US federal domains. PCI DSS v4.0 mandates DMARC for organizations processing payment card data as of March 2025. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) since February 2024, and Microsoft began rejecting non-compliant email in May 2025. The UK NCSC, Australia’s ASD, and Canada’s CCCS all mandate DMARC for government domains. Cyber insurers increasingly require DMARC enforcement as an underwriting condition.

Businesses can’t afford to risk the confidentiality, integrity, and availability of their critical assets, prompting them to take email security seriously. That’s exactly why SPF, DKIM, and DMARC protocols have become the primary personnel of the email defense toolkit. Together, these three email authentication protocols help **domain owners ensure that only authorized entities send emails on their behalf and that tampered emails don’t get delivered.

Why should you avoid sharing email accounts?

Shared email accounts can pose significant cybersecurity risks, especially when not properly managed. Here’s why:

1. Weak access control

Weak passwords are **one of the common reasons for email break-ins . There are so many tools that allow hackers to crack easy passwords. If multiple people share an account, there are chances that the password is something very easy to guess. This is done so that everyone can remember it. While it’s convenient to use simple passwords, it takes hackers no time to crack them and break into the shared account. 

Chances are that the same password is used across multiple shared accounts, increasing exposure to threats and breaches. To reduce this risk, it is always suggested that **unique and strong passwords be used for every account. A strong password includes upper- and lower-case letters, numbers, and special characters.

2. Lack of accountability

If multiple people share one email account, keeping a log of who has done what is practically difficult. So, if there is a breach attempted by an insider and some sensitive data gets shared or a phishing email is sent, it’s very difficult to tell who it was. The situation gets all the worse when more than 3-4 people are sharing the account.

If we keep aside the cyber threat concerns, then it’s also a challenge to figure out who has responded or sent which email. This can cause problems in other aspects of a business, such as sales, customer support, media communication, etc.

Also, a lack of accountability isn’t about blaming people. If there is a security issue, it’s important that you know who needs more training so that only those users get the help they need - without frustrating those who already follow best practices. Accountability also does good for the workflow; if no one knows who’s supposed to reply to which emails, team members may waste time checking every message to make sure nothing gets missed.

3. Higher risk of phishing

When there are multiple users, chances are that not all of them will be equally aware of phishing red flags. While one cautious user might recognize a phishing attempt, another untrained person might click a malicious link or open an infected attachment.

Also, threat actors rely a lot on impersonation. With shared accounts, messages are usually not addressed to a specific person (like ‘Hi John’), making generic phishing all the more believable and successful. Team members are used to **impersonal communication in these inboxes, so a fake email may not raise red flags.

Another thing that increases the risk of phishing is the frequent forwarding of emails. This is because shared email accounts are often used to forward emails internally. So, if a phishing or email slips through and gets forwarded to others, the risk will spread to other departments and sometimes even external contacts.

4. No support for MFA

You already know that multifactor authentication, or MFA, adds an extra layer of security to your password protection . It requires users to verify their identity using something more than a password - like a code sent to your phone, an app notification, biometrics, etc. This is one of the most effective ways to **protect email accounts from unauthorized access.

However, MFA is not a feasible option with shared email accounts, and this stands as a serious cybersecurity risk.

MFA is designed for individual use. It sends the second step (like a code or app prompt) to a specific person’s device. But with shared accounts, who gets the code or notification, and who approves the login?

If only one team member receives the MFA prompt, others can’t log in without coordination. To avoid this, many teams turn off MFA entirely, which leaves the account vulnerable. With no MFA, you are only left with a password, and if that’s also weak, then any attacker can get in easily.

5. Credential leakage

To make sure every user of the shared account can access it, the password is often written down on sticky notes, saved in unencrypted documents like spreadsheets or text files, or sent through emails, Slack, or WhatsApp. This increases the possibility of the password being accidentally or intentionally stolen by ill-intended people. 

Also, since the same password has to be used by multiple people, it rarely gets updated. As a result, hackers get more time to steal and exploit it.

And you know what’s more dangerous - one of the users left the company and still has access because nobody bothered to change the password. Over time, this creates a long, invisible list of people who might still be able to log in.

6. Data retention

If one user has deleted an email attachment for safety purposes, and some other user has already downloaded it on their device, then the data still exists. This can be dangerous when dealing with sensitive details and can even open gateways for phishing and BEC attacks.

Hackers will easily steal and encrypt data, refusing to delete it until they receive a ransom.

7. Non-compliance

Healthcare, legal, government, and other industries are required to abide by strict data protection and communication laws, including email security. Most data compliance policies require organizations to not share email accounts, regardless of purpose. This ensures the privacy and integrity of organizations, employees, and customers.

Therefore, violating these laws will only increase your legal, financial, reputational, and operational problems.

8. Complex systems

Whenever there is a security issue, it gets hard for the IT person to figure out who did what, which device was involved, and how the problem started. Also, some users might need full control of the account, and others don’t. What do you do in such situations? Unfortunately, you can’t set different access levels in a shared account, making it tough to manage safely.

9. Increased risk of social engineering

Social engineering means manipulating people into giving up confidential details or performing certain actions that compromise security. Now, with multiple people using an email account, the cybercriminal also gets multiple victims to trick. They can pick a seemingly easy target and convince them to click a malicious link or enter login credentials on a spoof site.

10. Access restriction

Depending on the responsibilities and hierarchy, users will need different levels of account access. With shared email accounts, you can’t set different levels of access control, allowing and exposing every user to every email activity.

With no role-based permissions, everyone can read, delete, or send emails - even those who shouldn’t. Even users who only need to read emails can access account settings, change passwords, or connect insecure third-party apps - opening doors for attackers.

Alternatives to shared email accounts

Here are some **safe practices that can help you achieve the same goal as sharing email accounts–

• Using shared mailbox for teams. This method doesn’t require sharing passwords, and access is managed with user permissions.

• Set up rules to forward specific emails to another person or team.

• You can delegate access to someone else who can read/send emails on your behalf.

• Use helpdesk platforms like Zendesk, Freshdesk, and Front. These are especially useful for customer support teams as all emails to a shared address go into a ticketing system, and each user gets their own login to handle queries.

Protecting your email should be one of your top priorities. Get in touch with us to know how we can help with this.

Sources

• RFC 7208 - Sender Policy Framework (SPF)
• RFC 7489 - Domain-based Message Authentication, Reporting, and Conformance (DMARC)