The basic answer is SMTP.

HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client (in this case). In the case of IMAPS or POP3S, the same would be true - that encryption protects the communication between the mail client and the IMAP or POP3 server.

In order for these to 'see' the mail, it first needs to be sent between hosts via SMTP.

When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).

There is a long list of who that could be.

It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on.

The basic answer is SMTP.

HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client (in this case). In the case of IMAPS or POP3S, the same would be true - that encryption protects the communication between the mail client and the IMAP or POP3 server.

In order for these to 'see' the mail, it first needs to be sent between hosts via SMTP.

When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).

There is a long list of who that could be.

It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on. The same would be true of all network providers between the bank and Google, and the same would be true of anyone at Google able to sniff the relevant traffic.

Basically, if you run a traceroute from you to google's server, everyone on that can see your email.

Plus any state-level actor, it seems, with a passing interest.

The 'last-mile' between you and your inbox, though, should be safe(r) if properly encrypted (and assuming your machine isn't compromised).

The basic answer is SMTP.

HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client.

In order for the mail client to 'see' the mail, it first needs to be sent between hosts via SMTP.

When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).

There is a long list of who that could be.

It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on.

The basic answer is SMTP.

HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client (in this case). In the case of IMAPS or POP3S, the same would be true - that encryption protects the communication between the mail client and the IMAP or POP3 server.

In order for these to 'see' the mail, it first needs to be sent between hosts via SMTP.

When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server).

There is a long list of who that could be.

It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on.