I sent a sensitive email with an attachment to the wrong email address. Is there a way to invalidate (or pull back) this email and the attachment remotely? The email was sent out via the aol.com email agent.

I know there is a way to invalidate an attachment sent along with the email, but I am not sure about the email itself.

  • 40
    “I know there is a way to invalidate an attachment sent along with the email,” – There isn’t. Only if the attachment were encrypted and could only be decrypted using an online service would such a thing be feasible. – Daniel B Jan 10 at 16:05
  • 2
    I got an email in my yahoo account from a company's domain that had an attachment (sensitive doc). Obviously, that email was not intended for me. Later, that company was able to make that attachment empty on my end. Any idea on how this attachment was emptied? – Ling Jan 11 at 3:12
  • 33
    It was likely not an attachment, but a link. – Martin Argerami Jan 11 at 3:24
  • 3
    @Sunny Only between AOL users. There is no way to unsend a normal email. – Asteroids With Wings Jan 12 at 10:55
  • 3
    @Sunny Not true. It can also be done with Microsoft Exchange, under certain specific conditions. I've seen quite a few emails get pulled that way, where I hadn't opened them before they were pulled. It's called "Message Recall". – InterLinked Jan 12 at 17:18

Is there a way to invalidate (or pull back) this email and the attachment remotely?

Normally no.

However, some email services have a short window when you can "recall" mail:

  • gmail - 30 seconds maximum - during which you can cancel sending email(s) (so it's not a true "recall")
  • outlook - you can un-send email in Outlook only if that email is internal (both you and your recipient have an Office 365 or Microsoft Exchange email account in the same organization) and it hasn’t been viewed yet.
  • yahoo - not possible
  • AOL Gold (and AOL Mail in general) no longer offer this feature
  • 73
    To clarify Gmail - IIRC this is less the ability to "recall" an email as much as the email is prevented from sending for n seconds in case you change your mind. – Kaz Wolfe Jan 11 at 0:45
  • 23
    @KazWolfe That's exactly what happens. The "Undo" in Gmail is not real. It's simply not sent until that time is past. All your emails will end up being sent 30 seconds later if you turn on this option. If you use email like IM, this is actually slows things down (but you shouldn't use email like IM anyways). – Nelson Jan 11 at 1:06
  • 1
    People in my organization (that uses Exchange) have been surprised when recalling Email sent to me doesn't work. I don't really know why, but the delete seems to happen on the server but not propagate to my email client which I leave running in the background all the time. – Joshua Jan 11 at 21:32
  • 2
    @Joshua If you make a local copy and set the client to delete the local copy only after an explicit delete-move command, deleting the mail on the server after the syncronization by the client, has no effect on your local copy... – Hastur Jan 11 at 22:54
  • 2
    @Joshua: The Exchange recall feature will probably not work over IMAP. It is designed to work in an environment where Outlook connects to Exchange using native Exchange interface. – raj Jan 13 at 15:37

In a practical way, no.

The situation is analog to regular mail. Once you drop a letter in the mailbox, it is pretty much gone. Now, not discussing the legal aspect, in principle you could remove the letter from the mailbox until the time the truck comes to pick it up. After that, you could somehow stop the truck, and the same with different parts of the delivery process. But it would require, even in the best of cases, good timing and a little persuassion. Lastly you could also get the letter from your recipients mailbox before they open it.

In the electronic case, the situation is similar. After you send an email it usually passes from server to server (usually at least two), and it stays at the destination server until the client checks their email. In principle, again, you could stop the process at any time by deleting the file from the corresponding server before it is sent to the next one. Thing is, most of the time this happens fairly quickly (seconds, although in some cases it could be hours and sometimes even more in the past). And in general you don't have access to any of the servers involved.

Summary: technically possible, during a usually short window; basically impossible in practice.

  • 8
    But in almost all cases, you don't have the technical ability to get to the servers in time to stop the email from being sent onwards. Like chasing the mail truck: if the driver goes faster than you can run, you can't stop it. Really the only remotely feasible method would be to hack into the recipient's email account, and delete the message before it's read. – jamesqf Jan 11 at 18:27
  • 1
    "it usually bounces between a few (at least two) servers" I should hope it doesn't bounce between servers as this implies going back and forth between them, not just one way. It's a minimum of one server when you consider that you could be emailing someone on the same system that you use – roaima Jan 12 at 7:11
  • 4
    @roaima I don't think that's implied at all. A pinball can bounce off many obstacles in the pinball machine; that doesn't require it to touch any of them more than once. – Asteroids With Wings Jan 12 at 10:56
  • 1
    @AsteroidsWithWings, I think, roaima wanted to highlight that when it comes to e-mail, the term "to bounce" has special meaning: for an e-mail server which is sent a message, to bounce it is an action opposite to receiving it (for delivery of forwarding further). Hence when once says "a message bounced" means some MTA in the chain of transfer rejected to handle the message and sent back another one describing the details of that mishap. – kostix Jan 12 at 13:41
  • 2
    @Asteroids With Wings: The language problem isn't with bounce, it's with between. Like the pinball: it generally bounces from bumper to bumper on its way down the board, but seldom actually between any two. – jamesqf Jan 12 at 17:21

I know there is a way to invalidate an attachment sent along with the email, but not sure about the email itself.

This, also isn't true. Attachments are just encoded in a way that allows the email system to transfer them, but they are carried within the same message. This would be different if you don't actually attach the file, but instead upload the file to some separate server and only send a link. This could be as simple as an HTTP server and an URL to the file, or it could be something done by a more sophisticated document control system.


Simply put, you cannot.

Send a follow-up email requesting that the receiver delete the previous communication as it is private information sent in error.

It will be nice if they respond but do not demand a response from this person.


How to pull back an email that has already been sent?

After it was sent, probably in no way, but

the administrator of the receiving server (who manages the mailbox of the e-mail address of the wrong recipient), could still physically delete the mail from the server before it is accessed. It is a question of time and opportunity.

Time. This is obviously useful as long as it has not yet been downloaded. After that, he can still delete the server copy, but he cannot delete the downloaded one(s).
Opportunity. The administrator of the receiving server may have not the legal right to do it. Or even the possibility to act in time.

However, if it is an email within the company and an internal server is used, an email to and a quick phone call to the mail administrator could still be sufficient (when the company policies allow it).

Safe procedures at work

Instead, you may need to use in advance safe procedures at work, especially dealing with sensitive content.

  • Use encryption , e.g. PGP, for the attachment with the public key given by the receiver. If you sent the attachement to the wrong people they will not be able to read. Using the key given by the right receiver you doublecheck your work.

  • Put attachments as links to a (local) cloud copy instead of the file. It is easy and quick in this case to delete, rename, change the permission to the file so that the link included in the mail become broken.

  • Use encryption and send the password via a different communication way. (Once again doublechecking).

Some words more (tl;dr)

An email written on your computer is sent from your client (outlook, your web browser ...) to a sending mail server which processes the request by sending it to a receiving server. Received mail is here archived with the attachment in the final recipient area, waiting for the user to download it. Everything happens in a few moments.

You can act in each step:

  • Before it exits from the sending server.
    Some clients and some provider online pages (gmail ...) have a grace time: they allow you to defer the sending time by a few seconds (usually up to 30): this is a compromise between immediacy shipment and the time to reconsider/realize that an attachment is missing, or there has been an inadvertent sending. You have read an undo action, but the mail has not actually been sent yet.

  • After it is received but not delivered to the final recipient.
    Some services (Microsoft, ...) allow to pull back a mail, within a corporate network; it does not always work when the deletion occurs after synchronization by a client set to make local copies and delete only at the explicit request of the user.
    If you can contact and convince the administrator of the receiving email address in time, they can delete the mail not yet downloaded.

  • 2
    Gmail isn't really a true client, but that reminds me of something similar that can be done in a real mail client. Real mail clients fully support working offline and have an Outbox for sending mail. Occasionally, my connection to the server will stop working for a few minutes so messages will stay in my Outbox until that works again, but I could also manually suspend outgoing mail and choose to send my messages at a specific point. Effectively, the Gmail feature keeps the message in the outbox for 30 seconds, but in a mail client you can disable automatic sending and get the same "feature". – InterLinked Jan 12 at 17:22
  • 1
    @InterLinked Rather than ranting about GMail not being a True Scotsman, you could just have said "in many mail clients". There have probably been hundreds of mail clients over the years, some of which worked that way and had those options, and some which didn't; I don't think defining the term "mail client" to only include those that do is particularly helpful. – IMSoP Jan 12 at 22:20
  • @IMSoP Gmail isn't a real mail client. That's just the reality. Neither is Yahoo, neither is Outlook.com, etc. Outlook, Thunderbird, MailNews, those are mail clients. Gmail is a webmail interface. I have Gmail accounts but I never log in to mail.google.com. Mail clients are programs that run locally, most of which has a number of basic features that virtually no webmail service (including Gmail) has. – InterLinked Jan 12 at 23:13
  • 3
    Gmail webmail app is a mail client, that connects to Google mail servers. It just happens that the client is running on Google servers as well and you access it via a web browser. It is a similar situation as when you access your mail the "old-fashioned" way, by ssh-ing into the server and using a console mode mail client that runs on the server, like mutt or pine (I still prefer to do exactly this instead of using a local mail client). – raj Jan 13 at 15:43
  • @InterLinked, meh, I would wager gmail also has features some "real" mail clients don't have. In any case, a web client that under the hood accesses a mailbox via e.g. IMAP would still be a mail client just in the way a dedicated binary on your machine that accesses it via IMAP. no? – ilkkachu Jan 13 at 16:15

As far as I know, this is possible only in Microsoft Exchange environment - when both you and the recipient are using Microsoft Exchange and Microsoft Outlook for your mail. There is a function in MS Outlook called "Message Recall" that allows to do this, but only under a condition that the recipient hasn't viewed the message yet.

In other cases, there is no possibility to withdraw an already sent email.


if you are using office 365 you can [![enter image description here][1]][1]

use this option but only inside the organization [1]: https://i.stack.imgur.com/qchP5.png

  • Just posting a (Hebrew) screenshot is not going to help many here. – Berend 2 days ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.