What breaks when email is treated as a trusted identity signal?

Why This Matters for Security Teams

Email is often treated as a convenient proxy for identity because it is ubiquitous, easy to route through business workflows, and already tied to account recovery. That convenience becomes a control failure when an inbox is assumed to prove who someone is, rather than where a message came from. Once email becomes an identity signal, attackers only need mailbox compromise, forwarding rule abuse, or convincing impersonation to move from message delivery into access change.

Security teams should separate communication trust from identity trust. A mailbox can support notifications, approvals, and audit trails, but it should not be the sole factor that authorises password resets, delegated access changes, payment approvals, or privilege escalation. NIST control families such as NIST SP 800-53 Rev 5 Security and Privacy Controls reinforce the need for stronger authentication, access enforcement, and verification of high-risk actions. The practical issue is not whether email can be secured, but whether it can be trusted enough to change identity state.

In practice, many security teams encounter this failure only after a reset link, approval email, or delegated mailbox rule has already been abused to change access or authorise a fraudulent action.

How It Works in Practice

When email is used as a trusted identity signal, the organisation builds workflows that treat possession of an inbox as evidence of authority. That assumption appears in password reset flows, service desk validation, shared mailbox delegation, procurement approvals, HR exceptions, and admin request routing. The weakness is not email itself, but the jump from “reachable at this address” to “entitled to change this account or process.”

Good practice is to classify email as a communication channel, then layer independent verification on top for sensitive actions. That usually means step-up authentication, out-of-band confirmation, signed approvals, help desk scripts with stronger proofing, and tight logging around all recovery and delegation events. Where identity assurance matters, NIST SP 800-63 Digital Identity Guidelines are a useful reference for distinguishing identity proofing, authentication, and lifecycle events.

• Use email for notification, not as the sole proof of authority.
• Require stronger checks for resets, beneficiary changes, and privileged requests.
• Protect mailbox accounts with phishing-resistant authentication where possible.
• Monitor forwarding rules, mailbox delegation, and recovery changes as high-risk events.
• Log who approved, what changed, and which verification factor was used.

For teams looking at the control plane rather than just the account plane, the NIST Cybersecurity Framework 2.0 helps frame email abuse as an identity, access, and governance problem, not just an anti-spam issue. This guidance breaks down in heavily automated service environments where email remains embedded in legacy approval chains and there is no clean way to separate notification from authorisation.

Common Variations and Edge Cases

Tighter identity verification often increases friction, so organisations have to balance user convenience against the risk of silent workflow compromise. There is no universal standard for every use case yet, especially in environments that mix customer support, employee administration, and third-party operations.

Some teams treat email as acceptable for low-risk notifications but not for privileged actions. Others apply it only as one signal among several, such as device trust, session continuity, or a human callback. In regulated environments, the threshold is usually lower for accepting email as evidence of authority because auditability and non-repudiation matter more than speed.

The edge case is delegated or shared mailboxes. These can look legitimate while hiding role abuse, stale access, or overbroad forwarding. That is where identity and operational trust collide: the account may be valid, but the person acting through it may not be the person entitled to request a change. Guidance from OWASP Authentication Cheat Sheet remains relevant here because authentication strength should match the impact of the action. For fraud-resistant workflows, CISA guidance on phishing-resistant MFA is a practical baseline for reducing mailbox-driven compromise.

As a result, the question is less about whether email is secure enough in general and more about whether it should ever be allowed to change access, money, or administrative state on its own.

Related resources from NHI Mgmt Group

• What breaks when identity governance is treated as admin work instead of security work?
• What breaks when identity is treated as a login layer only?
• What breaks when identity is treated as an administrative task instead of a control plane?
• What breaks when identity recovery is treated separately from identity defence?