Tax Documents Sent to the Wrong Email Address: What to Do
Contain the mistake, find out what the recipient could access, and take the right steps to protect the people named in the files.
If you sent tax documents to the wrong email address, use Undo Send if it’s still available. If you shared a link, revoke access immediately. If you sent a regular attachment and the message went through, assume the recipient could access it while you check what happened.
Act before you resend. A link can often be disabled. An attachment delivered to an outside inbox generally cannot be pulled back. Deleting the email from your Sent folder does not delete the recipient’s copy.
Stop access
Cancel the send if possible. Disable shared links and remove the wrong recipient’s permissions.
Identify the exposure
Check the address, files, message body, and whether the recipient had a way to open the files.
Protect and document
Take steps based on the information exposed and keep a private record of what you did.
1. Take the first steps as soon as you notice
- Use Undo Send if it’s on screen. Once the cancellation window closes, move on to containment.
- Revoke shared access at the source. Disable the original link or remove the recipient from the file or folder. If the link allowed anyone with it to open the file, removing one named user may not be enough.
- Check the actual address and contents. Look at To, Cc, and Bcc. Review attachments, the subject line, and any quoted thread. Record the send time and any bounce, recall result, or access log.
- Tell the right person. If you used a work account or sent someone else’s records, alert the responsible firm or security contact promptly. If your preparer was the intended recipient, call the office using a number you already trust.
For your own records, if you can safely contact a known unintended recipient, ask them to delete the email and any copies and confirm. Don’t repeat sensitive details or attach the original. If the address looks suspicious or the files belong to clients, let the firm’s incident lead handle contact.
2. Know what email recall can and cannot do
| What you sent | What to do |
|---|---|
| Gmail message just sent | Click Undo while it’s available. Gmail’s cancellation setting ranges from 5 to 30 seconds. It does not retrieve a delivered email after that window. |
| Outlook work or school message | Try recall if both mailboxes are eligible Microsoft 365 accounts in the same organization. Check the recall result. Do not count on recall for a message sent outside the organization. |
| Shared portal or cloud link | Revoke access and check available logs for views or downloads. Revoking access cannot remove an earlier download. |
| Encrypted file or ordinary attachment | For an encrypted file, check whether the recipient also got the passphrase or can otherwise open it. For an ordinary delivered attachment, assume it could have been copied. |
A bounce may show that one address rejected the message. Check that it applies to the wrong address and whether any other recipients got it. No reply or read receipt does not establish that nobody opened it.
A shared link and an attachment call for different steps
You sent a W-2 to a lookalike address. If the email only contained a link that required your preparer’s verified account, disable the link and check who had permission. If the email included the W-2 itself, disabling a link won’t help. Review which identifiers the W-2 showed and follow the steps for those details.
3. Match your next step to the information exposed
- Social Security number: Use the FTC’s data exposure guidance. Review your credit reports and consider a credit freeze. An IRS Identity Protection PIN can help guard against fraudulent federal return filing; it serves a different purpose from a credit freeze.
- Bank or card details: Contact the bank or card issuer through a verified number. Ask what to monitor and whether it recommends replacing any account details.
- Passwords or recovery information: Change exposed passwords from the real site, including anywhere you reused them. Review account activity and use the provider’s recovery or security controls.
- Signs of tax misuse: If the IRS contacts you about a return you didn’t file, or your return is rejected because your SSN was already used, follow the IRS identity theft guide. A misdirected email alone doesn’t establish tax identity theft or automatically require Form 14039.
Check for spouses, dependents, and other people named in the documents. A single return can expose more than one person’s information.
4. If a preparer or employer sent the email
Contact the organization using a number you can verify. Ask which documents and fields were exposed, what the recipient could access, what the organization did to limit exposure, and when you’ll get a written update. Keep a copy of that update with your incident notes.
If you work at the firm, report the incident internally and preserve the records your response team needs. The firm should assess any notice or reporting duties based on the facts and applicable rules. The IRS has separate data compromise guidance for tax professionals, including how to contact an IRS stakeholder liaison.
5. Use this checklist before you resend
- I checked the full address, not just the display name.
- I recorded what was sent, what was visible, and which access I removed.
- I confirmed the right destination independently and will use the verified client portal if available.
- I noted any follow-up date and told the responsible person or organization.
Frequently asked questions
Does a deletion confirmation prove the file was never copied?
No. It can help document your response, but it can’t rule out earlier downloads, forwarding, or screenshots.
What if the file was password protected?
Verify whether the file was encrypted and whether the unintended recipient also had the passphrase. Sending both together can defeat the protection.
What if I received someone else’s tax documents?
Don’t forward or open the attachment. Alert the sender through a verified contact method if you can, and follow your organization’s reporting process if it arrived at work.
Stop access first. Then protect what was exposed.
Find out what the recipient could actually see, keep a record of the steps you took, and confirm a secure destination before sending the documents again.