You sent a file to the wrong person: what can be undone and what cannot

The first minute is worth more than everything after it. Before reading further: if the file is on a share link you control, revoke the link now, then come back.

The window, by channel

The pattern: anything that leaves a copy on your infrastructure can be revoked; anything that pushed a copy to theirs cannot. An email attachment is a copy that has already arrived. A share link is a pointer you still hold, which is exactly why revoking it works — and why a link's lifetime matters so much in the first place.

What to do, in order

1. Revoke or delete first, read the room second. Every minute reduces the chance the file is still only on your side. Do not compose an apology before you have pulled the link.
2. Find out whether it was opened. Cloud drives show access; some transfer services show whether a download happened. This single fact decides whether the rest is cleanup or a real incident.
3. If the file contained credentials, rotate them now. API keys, passwords, tokens, a database dump with hashes. Assume compromise; rotation costs an hour, the alternative does not have a fixed price.
4. Tell the recipient plainly and ask them to delete it. This is not a legal remedy and does not bind anyone, but most misdeliveries go to a colleague or a neighbouring address, and most people simply delete it when asked. Ask them to empty the trash too.
5. If the file held other people's personal data, escalate rather than handle it quietly. Under GDPR a personal-data breach is notifiable to the supervisory authority within 72 hours; Türkiye's KVKK has an equivalent 72-hour expectation. That clock starts when you become aware, not when someone decides how serious it is — and quietly deleting a link is not a defence.

What cannot be undone, no matter what the button says

• Anything already downloaded. The copy is on their disk and there is no reach into it.
• Anything already forwarded. You are now one hop back from a chain you cannot see.
• Screenshots, and previews cached by the mail client or chat app.
• Anything in a backup — theirs, their employer's, or the platform's. Backups are the reason "delete for everyone" is a courtesy rather than an erasure.
• Anything a mail server has already archived for compliance, which in regulated industries is everything.

Making the next one cheaper

The structural fix is not to be more careful — everyone is already trying to be careful. It is to send files in a form where a mistake stays revocable.

• Prefer a code or link over an attachment. An attachment is an irrevocable copy the moment you press send. A pointer stays yours a while longer.
• Keep expiry short. A mistake you discover on Thursday is already fixed if the link died on Wednesday — see how long a shared file should stay downloadable.
• Check the recipient before the file, not after. Autocomplete picking the wrong same-named contact is the single most common cause, and it happens in the field you filled in first and looked at least.
• Send the identifier and the secret on different channels. If the code goes to the wrong person but the second factor does not, the mistake is inert.

More guides