When it's already happened
I emailed the wrong person at work. How bad is it?
You sent it to the wrong Sam, possibly with a file attached. Here is what recall can and cannot do, how to tell whether this is an awkward moment or a reportable data incident, and exactly what to write in either case.
Recall rarely saves you; a short, honest follow-up almost always does. And if other people's information left the building, tell someone the same day.
Last reviewed 2026-08-18 by Grayson Dodson. Free, plain-English guidance for everyday work technology.
Nothing is on fire. Here is what actually happened.
You typed three letters, Outlook or Gmail offered a name, and you took it. That is exactly what autocomplete is built to do, and it is the single most common way a message ends up with the wrong Sam. Outlook keeps its own suggestion list, sometimes called the auto-complete list or nickname cache, which remembers every address you have ever typed, including one you mistyped once and never used again. Gmail suggests from your contacts and from anyone you have emailed before. Neither one knows which Sam you meant. So no, you are not careless, and nothing is permanently broken. Email cannot be un-sent the way people hope, but the situation is almost always manageable, and it gets more manageable the sooner you deal with it. Before anything else, open the message in Sent Items in Outlook or Sent in Gmail and read the actual recipient line and the actual attachment name, slowly, out loud if that helps. Knowing precisely who received precisely what is the difference between a two-minute fix and a week of quiet worrying.
Recall: what it really does, and what it never does
Recall is real, and it is far weaker than its reputation. In desktop Outlook you open the message from Sent Items in its own window by double-clicking it, then go to the Message tab, choose Actions or the three-dot More commands menu, and pick Recall This Message. The hard limit is the one worth remembering: the recipient has to be inside your own Microsoft 365 or Exchange organization. Anyone at a different company, or on Gmail, Yahoo or Outlook.com, is completely out of reach, and no button will bring that message back. Inside your own organization, modern Microsoft 365 recall runs in the cloud and is better than it used to be, so it no longer depends on the message being unread or on the recipient using the Outlook desktop app; you get a recall report telling you which recipients it worked for. On older on-premises Exchange the weaker rules still apply, where an already-opened message, or one a rule has moved out of the Inbox, generally cannot be pulled back. Gmail is a different mechanism entirely: Undo Send is a short window of five to thirty seconds that you set in Settings, General, Undo Send, and once it passes the message is simply gone. The practical conclusion does not change: treat recall as a lucky bonus, not a plan, and send the follow-up described next.
The move that works better than recall
The thing that actually works is the one that feels worse for about ninety seconds: email the wrong recipient directly and ask them to delete it. Keep it short, factual, and free of grovelling. Something like this. Hi Sam, apologies, the message I sent at 2:40 with the attachment named Q3 payroll summary was meant for a different Sam and reached you by mistake. Could you delete it without opening or forwarding it, and let me know when you have? Thank you. That is the whole email. You are not confessing to a crime, you are giving someone a clear and easy instruction, and most people delete it and reply within minutes. Send it even if you also tried recall, because you will usually never find out whether the recall worked. If the wrong recipient is outside your company and you are unsure whether to contact them yourself, ask your manager or IT first, because in regulated work the employer sometimes prefers to make that contact. And keep their reply. A one-line deleted, no problem is genuinely useful later, both for your own peace of mind and for anyone who has to write this up.
Is this a reportable data incident?
Now the question the how-to-recall articles never answer. Ask yourself one thing: did other people's information leave the place it was supposed to stay? A meeting agenda sent to the wrong Sam inside your own company is an awkward moment and nothing more. A spreadsheet with names, dates of birth, Social Security or account numbers, salaries, medical or accommodation details, card or bank data, or a client's confidential file, sent to an address outside your organization, is a potential data incident, and your employer almost certainly has a process for exactly that. So is a message that went to the wrong external client, or one where the attached workbook had hidden tabs, a second sheet, or tracked changes you never opened. Report it. This is the part people get backwards: reporting is your employer's obligation, not your punishment. Privacy rules in many places put a clock on the organization measured in hours rather than weeks, and that clock only starts once the company knows. The people who end up in real trouble are almost never the ones who said this happened, here are the details, the same day.
How to report it, calmly, in five lines
Tell your manager, and tell whoever handles security or privacy. In most workplaces that is the IT service desk, an address like security@ or privacy@ your company domain, a Report an incident option in your intranet or ServiceNow portal, or a Data Protection Officer if your company has one. If you are on Microsoft 365, IT can often check whether the message was opened, so give them enough to search on: the exact time, the recipient address, the subject line, and the attachment name. Written plainly it looks like this. At 2:40pm today I sent an email with the subject Q3 headcount to sam.reynolds@example-supplier.com by mistake. It was meant for Sam Reynolds in Finance here. The attachment lists 42 employees with job titles, salary bands and home addresses. I emailed the recipient at 2:48pm asking them to delete it and have not had a reply yet. I have not deleted anything from my Sent Items. Let me know what else you need. No apology spiral, no excuses, no speculation about consequences. Facts, times, and what you have already done. Never delete the sent message or the reply thread. That is the one action that turns a mistake into a problem.
The two-second habits that prevent this
Two habits remove most of this permanently. The first is attaching the file before you write a single word. Open the compose window, attach, then type. It kills the forgot-the-attachment follow-up and the far riskier habit of grabbing a file in a hurry at the end. The second is looking at the recipient chip, the little rounded name pill that appears after autocomplete fills in a name. Click it, or hover for a second, so it shows the full address. Sam Reynolds and Sam Reynolds look identical on screen; sam.reynolds@yourcompany.com and sam.reynolds@example-supplier.com do not. Then set the safety nets once and forget them. Turn Gmail's Undo Send up to 30 seconds under the gear icon, See all settings, General. In desktop Outlook you can delay everything by a minute with File, Manage Rules and Alerts, New Rule, Apply rule on messages I send, then defer delivery by 1 minute. Take the External or Caution banner your company adds to outside mail seriously when it shows up on your own draft. And use Bcc whenever you are emailing a list of people who do not know each other.
Common questions
Can you unsend an email in Outlook after it has been read?
Only inside your own organization. Recall in Microsoft 365 works when the recipient is on the same Exchange organization as you; anyone on another company's system, or on Gmail, Yahoo or Outlook.com, is out of reach entirely. Within your organization, modern cloud-based recall does not depend on the message being unread or on which app they use, and you get a report showing where it worked. Older on-premises Exchange is much weaker. Because you often cannot tell which applies, the reliable move is a short, plain follow-up asking them to delete it, rather than waiting to see whether recall succeeded.
How long do I have to undo send in Gmail?
Between 5 and 30 seconds, and you get to choose. Click the gear icon, then See all settings, then General, and find Undo Send, where the cancellation period can be set to 5, 10, 20 or 30 seconds. Most people leave it on the default 5, which is not enough time to notice a wrong recipient. Set it to 30. Once that window closes the message is genuinely gone, because Gmail has no recall feature for mail that has already left, even between two people in the same Google Workspace.
I sent confidential information to the wrong person. Do I have to report it?
Usually yes, if the information belonged to other people and it left your organization. Names paired with dates of birth, Social Security or account numbers, salary or medical details, and client-confidential files are the clear cases. Tell your manager and the IT service desk or privacy contact the same day, and give them the time, the recipient address, the subject line and the attachment name. Reporting is a duty your employer carries, not a punishment aimed at you, and many organizations have a compliance clock that only starts once somebody tells them.
Will I get fired for sending an email to the wrong person?
Almost certainly not for the mistake itself. Misdirected email is one of the most common incidents in every organization, and reasonable employers treat a single autocomplete slip as exactly that. What causes real trouble is concealment: deleting the sent item, quietly editing the file afterwards, or hoping nobody checks the mail logs. If you report it promptly, keep the evidence including the recipient's reply, and cooperate with whatever follow-up your employer asks for, you have done everything that was genuinely within your control.
How do you politely ask someone to delete an email you sent by mistake?
Keep it short and factual, and ask for one specific action. Something like this works. Hi Sam, apologies, the message I sent at 2:40 with the attachment named Q3 payroll summary was meant for a different Sam and reached you by mistake. Could you delete it without opening or forwarding it, and let me know when you have? Thank you. Skip the long apology and the explanation of how it happened. People respond well to a clear instruction, and their reply confirming the deletion is worth keeping.