The Email Recall Myth: Insider Risk Starts With Everyday Mistakes

You hit Send and, a second later, notice the wrong attachment or the wrong name in the “To” line. Almost by reflex, you click Recall and hope it works. That moment is one of the most common faces of insider risk, and it rarely has anything to do with hackers.

So, can you recall an email after sending it to the wrong person? In most cases, no. Microsoft’s recall feature only works when sender and recipient share the same Microsoft 365 or Exchange organization, and even then only for messages that haven’t been opened. Once an email lands in an outside inbox, it’s out of your hands.

That’s why the more useful question isn’t how to take an email back, but how well your organization understands the way people handle sensitive data every day.

Can you recall an email? Not the way most people think

Email recall sounds like an undo button, but the two conditions above, a shared organization and an unopened message, leave very little room for it to work. Personal accounts, such as Outlook.com or Hotmail addresses, can’t use recall at all.

Those limits rule out the cases that matter most. Clients, partners, and vendors sit outside your organization, and their inboxes don’t take instructions from your mail server.

So the honest answer to “can you recall an email?” is this: only inside your own organization, and only if nobody has opened it yet. Everywhere else, the first send is final.

What one missent attachment shows about insider risk

In September 2026, Reuters reported that a senior Morgan Stanley banker in Asia sent a weekly client update with the wrong file attached. That file was the team’s deal pipeline, listing about 60 live IPO, M&A, and block trade deals, plus dozens more marked as pitching or on hold.

The banker tried to pull the email back, apologized, and asked recipients to delete the attachment. Those were sensible steps, but by then the file had already reached client inboxes.

The recall attempt couldn’t undo what had happened. Once the attachment left the building, getting it back depended on each recipient’s goodwill, so the fix had to come from people, not from a button.

No attacker was involved and no password was stolen. A trusted person with legitimate access did a routine task and made one small mistake. That is the core of insider risk, and it can happen at any organization, of any size, on any ordinary workday.

Most insider risk is unintentional

The Cybersecurity and Infrastructure Security Agency (CISA) defines insider threat broadly, covering anyone who uses their authorized access, “wittingly or unwittingly,” in ways that cause harm. On the unintentional side, CISA describes two types: negligence and accidents.

The industry term for the email example is an unintentional insider threat, and it’s also the most common kind. It lives in the tools people use all day, like email, shared drives, chat, and cloud apps.

According to Ponemon Institute’s 2026 Cost of Insider Risks: Global study, negligent insiders are the root cause of most incidents. Organizations averaged 13.8 negligent incidents in 2025, at roughly $747,000 each.

The volume keeps climbing, too. In Ponemon’s 2024 research, 57% of companies had more than 20 insider incidents a year, and in the 2026 study that share rose to 68%.

None of this means people are careless. Busy, well-meaning users make predictable mistakes, and over time those mistakes add up.

Related: Insider Risk Is Becoming Everyday Work Risk

Why training alone can’t close the gap

Security awareness training matters because it teaches users what sensitive data looks like and why it needs care. What it can’t do is remove the conditions that produce mistakes in the first place.

Think about how the error usually happens. Autocomplete suggests the wrong contact, two files share a similar name, or a recurring update goes out between back-to-back meetings. None of these are knowledge gaps, since the user already knows the rule and is simply moving fast.

That’s the limit of a training-only approach. It assumes people slip because they don’t know better, when most of the time they slip because they’re doing their jobs under real time pressure.

What works better is designing around how people actually work, with clear rules for which data deserves a second look and leaders who treat honest mistakes as signals rather than failures. It also takes something training alone can’t provide: a clear view of how people access, move, and share sensitive data day to day.

Insider risk management starts with understanding user behavior

Companies can reduce insider risk from everyday mistakes in two ways: they build a formal insider risk management program, and they learn how users really behave. The focus shifts from keeping attackers out to knowing what normal looks like inside. These two ideas often get blurred, but they’re different things.

Insider risk management is the program

Insider risk management (IRM) is an organization-wide program. It defines which data is sensitive, who should access it, and how the company responds when something goes wrong. Ownership is usually shared across security, IT, HR, legal, and compliance, and the goal is to manage risk from people with legitimate access, whether they act on purpose or by accident.

User behavior analytics is the lens

User behavior analytics (UBA) is a way of seeing. It establishes what normal activity looks like for users and roles, then highlights meaningful changes, such as a user who suddenly opens files they’ve never touched or shares data in a way their team never does.

In short, IRM decides what matters and how to respond, while UBA helps you notice when everyday behavior starts drifting from the norm.

Apply both lenses to the pipeline example. IRM asks whether a deal pipeline should travel in a routine client update at all, and who owns the response if it does. UBA asks whether attaching that kind of file to that kind of email is normal for that user. One sets the rules, and the other shows where daily reality differs.

What to do when a misdirected email goes out

Even with good habits, a misdirected email will eventually happen. When it does, a calm, rehearsed response limits the impact, because the faster a team acts, the fewer people see data they were never meant to see.

1. Report it right away: Make it easy and blame-free for users to flag their own mistakes, since speed matters more than perfect wording.
2. Confirm what was sent and to whom: Identify the recipients, the attachment, and the type of data involved.
3. Contact the recipients directly: Ask them to delete the message and confirm in writing that they haven’t shared it.
4. Assess the impact: Bring in legal and compliance to decide whether clients, partners, or regulators need to be notified.
5. Learn from the pattern: Look at what led to the error, then adjust workflows, access, or habits so it’s less likely to happen again.

An insider risk readiness checklist

Use this list to see how well your organization understands everyday insider risk.

1. Know which data is high-stakes: Deal pipelines, client lists, and financial forecasts deserve extra care.
2. Know who handles it: Map which roles and teams routinely access that data.
3. Understand normal behavior: Learn how sensitive data typically moves, so unusual activity stands out.
4. Make reporting safe: Users should feel comfortable raising a mistake within minutes, not hiding it for days.
5. Rehearse the response: Run a tabletop exercise for a misdirected email, just as you would for a phishing scenario.
6. Connect the teams: Security, IT, HR, legal, and compliance should share ownership of insider risk.
7. Revisit regularly: Roles, tools, and data change, so review this list at least once a year.

Frequently asked questions

Can you recall an email sent to someone outside your company?

No. In Microsoft Outlook, recall only works when the sender and recipients belong to the same Microsoft 365 or Exchange organization, and only for unopened messages. An email sent to a client, partner, or personal address can’t be pulled back, so the practical next step is to contact the recipient directly and ask them to delete it.

Why isn’t training enough to stop misdirected emails?

Training teaches users the rules, but most misdirected emails come from people who already know them. Autocomplete, similar file names, and time pressure cause the mistake, not a lack of knowledge. That’s why training works best alongside clear data-handling rules, blame-free reporting, and visibility into how sensitive data actually moves.

Is insider risk management the same as user behavior analytics?

No. Insider risk management is an organization-wide program that defines sensitive data, access, and response across security, IT, HR, legal, and compliance. User behavior analytics is a way to understand what normal activity looks like and spot meaningful changes. One sets the rules, and the other shows where daily behavior drifts from them.

Insider risk starts before you hit Send

The recall button will always be tempting, but by the time someone reaches for it, the data has usually left. Insider risk rarely starts with a hacker. It starts with a busy person, a familiar tool, and a routine task.

Organizations that manage it well don’t expect perfection. They know where their sensitive data lives, who handles it, and what normal behavior looks like, and when a mistake happens, they respond fast and learn from it. That’s the shift we encourage at Safetica: treating insider risk as part of everyday work, not a rare event.

A good place to start is the checklist above. Pick one item and bring it to your next security or compliance meeting, and to see how this works in practice, explore our insider risk management approach here.