Setting an out-of-office auto-reply is convenient. It tells people you are unavailable, manages expectations, and keeps your inbox from feeling ignored. But if your auto-reply shares too much, it can also give strangers useful information about your schedule, location, coworkers, travel plans, or home being empty.
A safer auto-reply keeps things simple: “I’m currently unavailable and will reply when I return.”
That is enough for most situations.
Why should your out-of-office message be vague?
Your auto-reply may go to anyone who emails you, not just trusted contacts. That includes unknown salespeople, scammers, newsletters, compromised accounts, fake recruiters, phishing senders, and people testing whether your email address is active.
Cybercriminals use small details to make scams more convincing. The FBI’s guidance on spoofing and phishing explains that criminals may disguise email addresses, sender names, phone numbers, or website URLs to convince people they are interacting with a trusted source.
If your auto-reply says exactly where you are, when you will return, who covers for you, and how to reach that person, you may hand a scammer a useful script.
What information should you avoid in an auto-reply?
A detailed auto-reply can reveal more than you intend. Avoid putting unnecessary personal, travel, or business details in messages that may go outside your trusted circle.
Do not include:
- Exact vacation dates
- Travel destination
- Hotel, conference, or event names
- Personal phone number
- Home status, such as “away for two weeks”
- Coworker names and direct email addresses when not needed
- Internal job responsibilities
- Approval authority, such as “I approve invoices”
- Emergency contact details
- Personal plans, family details, or location updates
A vague message protects privacy and still sounds professional.
How can scammers use an auto-reply?
Scammers can use auto-replies to improve phishing and social engineering. The FTC’s phishing guidance says scammers use email or text messages to trick people into giving passwords, account numbers, Social Security numbers, or other sensitive information.
An overly detailed auto-reply can help scammers:
- Confirm your email address is active
- Learn when you are not available
- Target coworkers while you are away
- Impersonate you with more confidence
- Send fake urgent requests
- Reference a real trip, event, or date
- Try to reset accounts while you are less likely to notice
- Build a more believable business email compromise attempt
The less you reveal, the less a criminal can reuse.
How big is the phishing risk?
Phishing remains one of the most common cybercrime categories. The FBI’s 2024 Internet Crime Report announcement said the FBI Internet Crime Complaint Center received 859,532 complaints in 2024, with reported losses exceeding $16 billion, and listed phishing/spoofing among the top three cybercrimes by complaint volume.
That does not mean every auto-reply causes a scam. It means attackers constantly look for small pieces of information that make scams easier to personalize.
How does this help someone become safer online?
Being vague in an auto-reply helps someone become safer online by limiting information exposure. Cybersecurity is not only about antivirus software and passwords. It is also about reducing the clues strangers can collect about your life.
A safer auto-reply helps protect:
- Your travel plans
- Your home address and physical safety
- Your coworkers and contacts
- Your work responsibilities
- Your email account
- Your personal schedule
- Your identity
- Your organization or household from impersonation scams
The rule is simple: share only what the sender needs to know, not everything they might want to know.
What should a safe auto-reply say?
Use a short, neutral message for most situations.
Safer auto-reply examples
Simple and secure
Thank you for your message. I’m currently unavailable and will reply when I’m able.
Professional but vague
Thank you for reaching out. I’m away from email at the moment and will respond as soon as possible.
For business inboxes
Thank you for your message. I’m currently unavailable. For general assistance, please contact our main support channel.
For job seekers
Thank you for your message. I’m currently unavailable and will respond as soon as I can.
For high-risk roles
Thank you for your message. I’m unable to respond right now. Please use established company channels for urgent matters.
What if people need urgent help?
If someone truly needs a backup contact, avoid sending a specific person’s direct information to every external sender. Instead:
- Use a shared mailbox
- Use a general support address
- Use a main office number
- Use an online help center
- Set different internal and external auto-replies when your email platform allows it
- Tell trusted contacts directly before you leave
The CISA guidance on avoiding social engineering and phishing attacks explains that attackers use human interaction to obtain or compromise information, and may use information from one source to make a later contact seem more credible.
Quick auto-reply privacy checklist
Before turning on your auto-reply, ask:
- Does this reveal where I am?
- Does this reveal when my home may be empty?
- Does this identify coworkers unnecessarily?
- Does this reveal internal processes?
- Does this tell scammers when I am not monitoring email?
- Could this message help someone impersonate me?
- Can I make this shorter and more general?
If the answer is yes, simplify it.
Your auto-reply should manage expectations, not publish your schedule. Keep it short, vague, and professional. Avoid exact dates, travel details, personal information, and unnecessary backup contacts.
