Return to Question

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

My name, my new address, current address, previous address, social security number, wife's name, my lender, the last 4 digits of my loan, my phone number, my employement history, my date of birth, my salary information, the full account numbers and balances for all of my checking/savings accounts are contained within the emails.

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail with unencrypted text/attachments? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server. So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected. Does that sound about right?

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

So it seems it was sent with TLS, which is good. But are the attachments/visible to my mail provider?

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

All sorts of personal information was in the documents - not just my SSN by my name/DOB/address/bank account numbers/etc/etc....

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail with unencrypted text/attachments? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server. So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected. Does that sound about right?

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

So it seems it was sent with TLS, which is good. But are the attachments/visible to my mail provider?

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

My name, my new address, current address, previous address, social security number, wife's name, my lender, the last 4 digits of my loan, my phone number, my employement history, my date of birth, my salary information, the full account numbers and balances for all of my checking/savings accounts.

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit (and Google's servers will forever have a copy of a .pdf with all of my personal information it).

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

Is my understanding basically correct. It was sent with TLS, but now the plain 'ol .pdf will hang out on Google's mail servers?

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

My name, my new address, current address, previous address, social security number, wife's name, my lender, the last 4 digits of my loan, my phone number, my employement history, my date of birth, my salary information, the full account numbers and balances for all of my checking/savings accounts are contained within the emails.

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail with unencrypted text/attachments? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server. So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected. Does that sound about right?

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

So it seems it was sent with TLS, which is good. But are the attachments/visible to my mail provider?

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

My name, my new address, current address, previous address, social security number, wife's name, my lender, the last 4 digits of my loan, my phone number, my employement history, my date of birth, my salary information, the full account numbers and balances for all of my checking/savings accounts.

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail? What is an appropriate response and how screwed am I?

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

My name, my new address, current address, previous address, social security number, wife's name, my lender, the last 4 digits of my loan, my phone number, my employement history, my date of birth, my salary information, the full account numbers and balances for all of my checking/savings accounts.

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit (and Google's servers will forever have a copy of a .pdf with all of my personal information it).

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

Is my understanding basically correct. It was sent with TLS, but now the plain 'ol .pdf will hang out on Google's mail servers?