Academy › Publishing › Domain and email

Cut first, ask questions later

By the end, you'll know how to cut off access to an email or domain the moment you suspect something, without waiting for full proof, and what to tell a customer who may have received a fake message in your name, before asking anyone for an explanation.

By Yodai · Published September 6, 2026 · Updated October 12, 2026

5 min read

A former manager of your WhatsApp booking line told you three months ago that they don't work with you anymore, but nobody revoked their access to the business email. Today a customer calls to confirm they've paid a quote, and gives you an account number you don't recognize. You don't know if it was them, if it's a third party who stole their password, or if it's an unrelated coincidence. All you know is that someone, with some level of access, was able to write in your name.

The question that's making you hesitate is the wrong one. It's not who did it. It's whether you cut off access now, with the little you know, or wait until you have full proof. If you wait until you're sure, every hour that door stays open is another hour it could happen again.

The cost of waiting

Changing a password can be undone in a minute if it turns out there was nothing there: you hand it back out and nothing's lost. Asking someone to explain themselves, only to find out later they really did have the email open, can't be undone: in those hours they could have already messaged anyone, requested a payment, canceled a booking, or deleted a conversation history. The decision isn't symmetrical, so don't treat it like one. When the cost of being wrong one way is an awkward apology, and the cost of being wrong the other way is a scammed customer, you cut access.

Cut access now or wait for proof

Cut off access as soon as you're suspicious

If it turns out there was nothing, you hand it back out in a minute and nothing's lost
If there was something, they can't keep messaging your customers
All it takes is changing a password, you don't need to explain anything to anyone

Wait until you're completely sure

You gain certainty before putting someone who might be innocent on the spot
If the access was real, every day that passes is another day they can write in your name
Full proof almost never arrives before the damage is already done

Which one I'd pick: Cut access right away whenever there's still an active way in: a password, an open session, a device with the app installed. Wait only if there's no possible access left behind the suspicion; then there's nothing to cut, you just need to ask calmly.

The first hour

What to do before calling anyone

1Change the password for your email and your domain
Not your personal account, the business email and the panel where your domain is registered. If several people use that account, that password is the only key that exists, so changing it locks everyone out, including you, until you hand it back out.
2Close the open sessions
Depending on the provider, changing the password doesn't always kick out whoever's already inside: Google, for example, signs you out almost everywhere, but not on some devices and apps. Look for the option to close all sessions or sign out of all devices, usually in the account's security settings, and use it before doing anything else.
3Check the Sent folder from the last few days
Not your inbox, your Sent folder. That's where you'll see if someone wrote in your name, who they wrote to, and what they asked for. It's what tells you whether there's a customer you need to warn.
4Tell your team, not the suspect
If you work with anyone else, let them know you've changed the access before they run into a locked door with no explanation. Don't say anything to the suspect yet, that comes later.

The mistake that buys the problem more time

The expensive mistake isn't cutting off someone who turns out to be innocent. It's messaging them first to ask. The moment they know you suspect them, if they really did mean to do something, they'll do it right away, before you can lock them out: send the message that was still pending, change a password recovery option, walk off with a contact. Cut access first, ask questions later, never the other way around.

If they've already messaged a customer

The notice to send if you find something odd in Sent

We're reaching out because we detected unauthorized access to our email. If you've received a message from us in the last few days asking you to pay into a different account than usual, don't act on it, message us directly at this number to confirm before making any payment.

Only once access is cut off and customers are warned does it make sense to ask questions. And you ask with what you've actually seen, not an accusation: show them the date and the message that went out from the email and ask them to explain it. If the answer has a reasonable explanation, you'll have heard it without anyone else getting hurt in the meantime. If it doesn't, it no longer matters whether you reacted in time, because you already did.

What comes next is what happens the day you decide your business needs an entirely new name.

All of this assumed your business is still called what it was yesterday. The day you change its name, the problem isn't an intruder, it's you migrating everything under pressure.

What you'll walk away with

You know that when you're suspicious, you cut off access first and ask questions later, without waiting for full proof
You know exactly what to check in the first hour: password, open sessions, sent emails, and a heads-up to your team
You know when it's okay to wait: only when there's no active technical access left behind the suspicion
You have the message ready to send a customer if they may have received a fake message in your name

In Yodai you connect the domain you already have to your site, and it stays registered where it is, in your name. See how your own domain for your website works.

NextWhen the business changes its name, migrate one role first, not the whole team