Email Accounts for Summer Staff That Never Close

Mailboxes nobody reads

By mid-October, a campground's summer staff are back at school or in other jobs. Their email addresses are still open, and so are the logins they used to post on the website.

Nobody reads those mailboxes now. Customers who once had a reply from one keep writing to it, about next year's campsite or a jacket left behind, while spam piles up.

Each account also has a password that a former employee knows, and often a phone somewhere that still collects its mail every few minutes.

Why a forgotten account is a risk

Automated attacks try common passwords against mail and website logins on servers everywhere, all day. An account nobody uses is the one where a successful guess can go unnoticed for months.

Once inside, an attacker can send spam through your mail server. Mail servers elsewhere then treat everything from that server with suspicion, including your invoices and booking confirmations.

A website login with editing rights can be used to change pages or plant hidden links. And a summer hire often uses one password everywhere, so a leak elsewhere opens yours.

What each summer hire was given

Before closing anything, list what each person received. Seasonal accounts tend to be created in a hurry in May, by whoever had a free moment.

• A personal mailbox on the business domain, often set up on their own phone.
• A website login for posting news, trail conditions or photos.
• Shared passwords for the office mailbox, the Wi-Fi or the booking system.
• Social media access, through their own profile or a shared login.
• Forwarders that copy a role address, such as bookings, to their mailbox or a personal one.

The last is the easiest to miss. A forwarder set up in June can still copy every booking enquiry to a former employee's free account in October, unseen.

Saving the mail before closing

Deleting a mailbox deletes the mail in it. Some of that mail matters: replies from customers, quotes from suppliers, and conversations about group bookings that carry over into next season.

Before anything is removed, have the mailbox copied into an archive account or downloaded into the office mail program, so the history stays with the business.

Then search the copy for anything still waiting. A customer who wrote in September about a family reunion next July is still expecting an answer.

Closing without bouncing customers

Once the mail is saved, change the account's password to one nobody knows, so every phone still syncing it stops. Then replace the mailbox with a forwarder to a role address that someone current reads.

Keep the forwarder through next season, since customers who saved the old address will still use it. An automatic reply can give them the address to use from now on, without announcing who has left.

For website logins, remove editing rights the day someone leaves. WordPress can pass a deleted user's posts to another account, so nothing disappears from the site.

A worked example

A heli-skiing operator in the Kootenays runs a remote lodge, with guided skiing in winter and heli-hiking in summer. Each season brings a dozen staff: guides, lodge hosts, a cook and kitchen help.

In October the office manager sat down to set up the winter crew's accounts and found every summer account still open, two of them still syncing to phones far from the valley.

One mailbox held messages from guests asking for photos of their August trip, unanswered. A forwarder was still copying the bookings address to a former host's personal account.

The manager had each mailbox copied to an archive, removed the forwarder and turned each personal address into a forwarder to the office. The website logins went, their trip reports passed to the lodge's own account.

The winter crew received role addresses instead, such as guides and kitchen, passed on from season to season. A one-page account list records who holds each password and the date it will change.

Each address now outlives whoever is using it. Guests keep writing to a box someone reads, and a departure means one changed password rather than a mailbox nobody owns.

Role addresses instead of names

An address like bookings or frontdesk belongs to the job. A customer who saves it in May can still use it in October, whoever is sitting at the desk.

Give role addresses to anything customers write to, and personal ones only to people reached by name, such as managers and guides who keep in touch with returning groups.

When a role passes to someone new, change its password the same day. In most hosting control panels that takes a minute or two.

Setting up next season's accounts

Create each seasonal account with its end in view. A staff account list records the person, every account they hold, and the dates each was opened and is due to close.

Give the lowest website role that does the job. A staff member who posts trail updates needs to write posts, not install plugins or change other people's accounts.

Have each person choose their own password on the first day, so nobody sends one by email, and make sure a manager can reset any of them.

Put the end of the season on the calendar as a task, with the account list attached. Closing accounts is easy when it is planned and easy to forget when it is not.

The counter-case

A business that hires the same few seasonal staff every year may reasonably keep their addresses over the winter, since returning customers know them by name.

Their passwords should still change at the end of each season, with any forwarders to personal accounts removed and the mailboxes checked now and then. A dormant account still needs an owner.

And a very small operation with one shared office address may have nothing to close. It still has a password every summer hire knew, and that password changes in October.

Closing this summer's accounts

1. List every account each summer hire was given.
2. Look for forwarders to personal addresses.
3. Copy each mailbox to an archive.
4. Answer anything still waiting for a reply.
5. Turn each address into a forwarder.
6. Remove website logins and reassign their posts.
7. Change every shared password they knew.

Step two cannot wait. A forwarder to a personal account keeps sending customer mail to someone who has left, and nothing in your own mailbox hints at it.

Next summer's hiring brings its own risk, in the attachments a job advertisement attracts, described in resumes by email while hiring for the summer.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.