# How do you protect a shared mailbox from spam and phishing?

URL: https://iblockspam.com/blog/shared-mailbox-spam-protection
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Running email day to day
Author: iBlockSpam Team

> Protect shared mailboxes such as sales@ and accounts@: name an owner, limit access, decide who reviews held mail, add payment checks and test every address.

## Short answer

Treat each shared mailbox as a team workflow. Give it a named owner, limit who can open it, filter its mail before delivery, and decide who reviews held messages and how often. Add payment checks for accounts@, block direct sign-in to the shared account, and test that real customer mail and released mail reach the shared inbox.

Shared mailboxes are where customers, suppliers and job applicants reach your business. They're also where responsibility gets vague: five people can open sales@, and each assumes someone else checked the held mail. This guide is about the team side of protecting them: who owns each address, who sees what, and how you prove real mail still gets through.

For how to publish addresses without attracting harvesters, and the choice between shared mailboxes, groups and aliases, see [how to protect public email addresses like info@](https://iblockspam.com/blog/protect-public-email-addresses-from-spam). This guide picks up once the shared mailbox exists.

## Why do shared mailboxes need their own policy?

A personal inbox has one owner who notices when something's missing. A shared inbox doesn't. Four things go wrong most often:

- **No owner for held mail.** Messages sit in quarantine until they expire, because everyone thought someone else was watching.
- **Too many delegates.** Each person with access is another account an attacker could phish to read or send from the shared address.
- **Broad exceptions.** A team that lost one order allows a whole sender domain, which weakens filtering for every message that claims to come from it.
- **A forgotten sign-in.** The shared account itself has a password and can be signed in to directly.

Each of these is a decision you can write down, which is what the policy template below is for.

Shared accounts also need their own sign-in rules. In Microsoft 365, a shared mailbox has a user account with a system-generated password, and Microsoft says it "isn't intended for direct sign-in". Block it, and give people access through their own licensed accounts instead, so every action is tied to a named person.

## Who should own each shared address?

Give every shared address a business owner, a backup, and a review rhythm that matches its risk. Adapt these examples to your own hours and service promises.

| Address | Main risk | Owner | Held-mail review | Extra control |
|---|---|---|---|---|
| sales@ | Lost leads; fake quote requests with malicious attachments | Sales lead | Several times a business day | Never open unexpected archives; ask the sender to use a link |
| accounts@ | Fake invoices; payment redirection | Finance lead | Before every payment run | Call-back on a known number for any bank change |
| support@ | Impersonated customers; urgent account changes | Support lead | Every shift | Verify identity before changing account details |
| careers@ | CVs with risky attachments | HR lead | Daily | Restrict attachment types; prefer an application form |
| info@ | General spam; misrouted inquiries | Office manager | Daily | Forward to the right team rather than replying in place |

The owner doesn't read every message. They make sure held mail is reviewed, access stays tight, and the team knows the rules.

## Who should see and release held mail?

Separate two jobs:

1. **Delegates** work the delivered mail in the shared inbox.
2. **The reviewer** (the owner and their backup) checks held mail and releases only what passes the safe-release checks in our [quarantine guide](https://iblockspam.com/blog/what-is-email-quarantine).

Then check how your filter and platform actually treat shared addresses. Don't assume.

- **Microsoft 365.** Microsoft's [quarantine FAQ](https://learn.microsoft.com/en-us/defender-office-365/quarantine-faq) says "A user must have a valid account to access their own messages in quarantine", and its [shared mailbox guidance](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes) says to "Always block sign-in for the shared mailbox account and keep it blocked." So plan for held mail to a shared mailbox to be handled by an admin, or through quarantine notifications that reach the right people. Our guide to [releasing quarantined email in Microsoft 365](https://iblockspam.com/blog/release-quarantined-email-microsoft-365) covers the admin side.
- **Google Workspace.** If the shared address is a Google Group, the group's own spam handling applies too. Google notes that "messages identified as high-confidence spam are always rejected even when you relax spam controls for a group" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/support/troubleshooting/legitimate-email-to-a-group-marked-as-spam)).
- **A filter in front of your platform.** Find out whether the shared address gets its own quarantine and digest, who receives the digest, and who can release. If the digest goes to the shared address, everyone with access to that mailbox may see it. In iBlockSpam, every address has a personal quarantine with scheduled digests, and admins can review the domain-wide shared quarantine. Test which people can see a shared address's held mail before you rely on it.

**Acceptance test:** hold a safe test message for the shared address. The reviewer should find it. A delegate who isn't a reviewer, and any user outside the team, should not be able to open it from their own quarantine.

## How do you protect accounts@ from payment fraud?

Filtering stops a lot of fake invoices, but it can't tell whether a supplier really changed banks. Some fraud comes from genuine supplier accounts that were compromised, and passes every authentication check. The FBI counted 305,033 business email compromise incidents and $55.5 billion in exposed losses worldwide between October 2013 and December 2023 ([FBI IC3 PSA](https://www.ic3.gov/PSA/2024/PSA240911)). Its advice includes using "secondary channels and/or two-factor authentication to verify requests for changes in account information".

For accounts@:

1. Confirm any bank detail change by phone, using a number from your records, never one from the email.
2. Require two people to approve a new or changed payee.
3. Log who asked, who checked and when.
4. Treat urgency and secrecy as warning signs, not reasons to skip a step.
5. If money has gone, call your bank at once; the FBI says "time is of the essence".

Our guides to [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) and [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention) go further.

## How do you avoid exceptions that weaken filtering?

When a real message is held, the quick fix is to allow the whole sender domain. Resist it. Microsoft warns that allowlists "create a high risk of attackers successfully delivering malicious email that would otherwise be filtered" ([Anti-spam protection FAQ](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-faq)).

- Fix the cause first: often the sender's SPF, DKIM or DMARC is broken. Check with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer).
- Allow a specific address, not a whole domain, and prefer entries that require the sender to pass authentication. See [allow and block lists](https://iblockspam.com/features/allow-block-lists).
- Put an end date on temporary exceptions and review them monthly.

Our [false positives guide](https://iblockspam.com/blog/false-positives-legitimate-email-flagged) walks through the options in order.

## How do you test each shared address?

Run these after any routing change, a new shared address or a new filtering rule. Keep the time and evidence for each.

| Test | Pass when |
|---|---|
| Plain message from an outside account | It arrives in the shared inbox, not Junk |
| Legitimate attachment of a type you accept | It arrives, or is held with a clear reason |
| Safe held test message | Only the named reviewers can see it |
| Release of that message | It arrives in the shared inbox |
| "I sent it yesterday" trace | An admin finds the message in the filter log and platform trace |

The step-by-step and a sign-off sheet are in [how to test that a spam filter is working](https://iblockspam.com/blog/how-to-test-spam-filter-is-working).

## A shared mailbox policy template

Copy this for each shared address and keep it with your IT notes.

| Item | Your answer |
|---|---|
| Address and purpose | e.g. accounts@ for supplier invoices |
| Business owner and backup | Names |
| People with access | List, reviewed on (date) |
| Direct sign-in blocked | Yes / No |
| Who reviews held mail, and how often | Names, schedule |
| Who may release which verdicts | e.g. reviewer: spam; admin only: malware and phishing |
| Exceptions in place | Sender, reason, end date |
| Messages that must never be lost | e.g. purchase orders, legal notices |
| Escalation | Who to call about a missing or suspicious message |
| Last full test | Date and result |

## What should the monthly review cover?

Ten minutes a month keeps the policy true:

- Remove delegates who changed role or left. See [employee offboarding](https://iblockspam.com/blog/employee-offboarding-email-security).
- Confirm direct sign-in is still blocked on every shared account.
- Check held mail was reviewed on schedule and nothing expired unread.
- Review exceptions and remove any that have ended.
- Check for new inbox rules or forwarding on the shared mailbox; see [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).

## Do shared mailboxes change what protection costs?

They can. In Microsoft 365 a shared mailbox under 50 GB needs no license of its own, but Microsoft's [licensing terms](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description) say Defender for Office 365 licenses are needed for "Shared mailboxes that benefit from Defender for Office 365 protections". iBlockSpam prices per domain, so shared addresses don't add to the bill; mailboxes are unlimited by count, and each domain includes 100,000 inbound messages a month. See [how much email security costs](https://iblockspam.com/blog/email-security-cost-small-business).

## Next steps

1. Fill in the policy template for your two busiest shared addresses, starting with accounts@.
2. Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your MX, SPF and DMARC before you test.
3. Run the five tests above on each shared address.
4. To see how per-address quarantines and digests look in iBlockSpam, try the [portal demo](https://iblockspam.com/demo) or compare plans on the [pricing page](https://iblockspam.com/pricing).

See more [operations guides](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### Who should review held mail for a shared mailbox?

Name one owner and one backup for each shared address, not the whole team. The owner checks held mail on an agreed schedule, releases only what passes the safe-release checks, and escalates anything that looks like a payment or account change. Everyone else handles delivered mail as normal. Write the names down and update them when people change roles.

### Can users release quarantined mail for a Microsoft 365 shared mailbox?

Plan on an admin or a notification route rather than assuming they can. Microsoft says a user needs a valid account to access their own quarantined messages, and it also says to block sign-in for shared mailbox accounts. Check what your quarantine policies and notifications allow for each shared address, and test it with a held message.

### Do shared mailboxes need their own security license?

In Microsoft 365, a shared mailbox under 50 GB doesn't need a license for basic use, and built-in spam and malware filtering applies. Microsoft's licensing terms say Defender for Office 365 licenses are needed for shared mailboxes that benefit from its protections. A per-domain filter in front of Microsoft 365 covers shared addresses without counting them.

### How many people should have access to a shared mailbox?

Only the people whose job needs it. Every extra delegate is another account that could be phished and used to read or send from the shared address. Microsoft caps a shared mailbox at 25 users and suggests a Microsoft 365 group beyond that. Review the list every quarter and when someone changes role or leaves.

### Why is accounts@ the riskiest shared mailbox?

Because it receives invoices and payment-change requests from outside, often from senders it trusts. Fraudsters target it with fake invoices, lookalike supplier domains and messages from genuinely compromised supplier accounts. Filtering helps, but only an independent check by phone on a known number can confirm a bank detail change is real.

## Sources

- [Microsoft Learn: About shared mailboxes](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes)
- [Microsoft Learn: Quarantined messages FAQ](https://learn.microsoft.com/en-us/defender-office-365/quarantine-faq)
- [Microsoft Learn: Anti-spam protection FAQ](https://learn.microsoft.com/en-us/defender-office-365/anti-spam-protection-faq)
- [Microsoft Learn: Microsoft Defender service description (licensing terms)](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-defender-service-description)
- [Google Workspace Admin Help: Legitimate email to a group is marked as spam](https://knowledge.workspace.google.com/admin/support/troubleshooting/legitimate-email-to-a-group-marked-as-spam)
- [FBI IC3: Business Email Compromise: The $55 Billion Scam (PSA I-091124-PSA)](https://www.ic3.gov/PSA/2024/PSA240911)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.

---

Source: iBlockSpam, https://iblockspam.com/blog/shared-mailbox-spam-protection (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt