6

I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.

All sorts of personal information was in the documents - not just my SSN by my name/DOB/address/bank account numbers/etc/etc....

Before I go off the deep-end here, can we just confirm that there is no such thing as a secure e-mail with unencrypted text/attachments? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server. So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected. Does that sound about right?

In the message headers I can see

Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)

So it seems it was sent with TLS, which is good. But are the attachments/visible to my mail provider?

Improve this question
12
  • 2
    There is a such thing! It's called encryption :) You should talk about your concerns with the bank manager. There are a lot of red flags being raised here. If this is how they handle PII in email, think of how they handle the rest of your information.
    – Some Dude
    Commented Jan 26, 2016 at 2:45
  • 8
    But are the attachments/visible to my mail provider? - yes, Google automatically scan GMail messages to provide advertising and Google Now features (source) and GMail engineers can potentially access any account as part of necessary work, with oversight (source). somewhere, at one of Google's data farms - many data farms, and backup tapes source
    – TessellatingHeckler
    Commented Jan 26, 2016 at 4:15
  • 3
    You should make that an answer @tesselatingheckler
    – Neil Smithline
    Commented Jan 26, 2016 at 5:14
  • 2
    @John PCI DSS does not list SSN as "Cardholder Data" and in any case PCI DSS only applies to payment cards, payment-card transactions, and payment-card accounts, hence the name "Payment Card Industry DSS". A mortgage is not a payment card/txn/account. What does apply in the US (at least theoretically) is Graham-Leach-Bliley epic.org/privacy/glba .
    – dave_thompson_085
    Commented Jan 29, 2016 at 2:59
  • 1
    I had a similar problem when purchasing a house this year. The bank, the realtor, the insurance company, everybody defaulted to sending sensitive information as email attachments. To be honest, it terrified me, but the process of buying a house moves so fast that I didn't have time to complain without possibly losing my bid on the property. There's good money to be made in creating an easy to use solution for this problem that financial institutions will adapt.
    – MusikPolice
    Commented Feb 1, 2016 at 16:22

1 Answer 1

Reset to default
2

There is a way to safely encrypt email, but you would know (without looking at the headers) since there must be a way for you to authenticate yourself as the receiver. If they put a signature cert on the email, that does not mean that it is encrypted, that only provides a way for you to confirm the identity of the sender. The encryption must be performed in addition, usually in the form of an add-on to your email client or a server to server encryption in a business environment. If there were any health questions in there, you could be looking at a HIPAA violation. You should question the security practices of an entity if this is a normal practice.

Improve this answer
1
  • 2
    HIPAA only apples to health care providers, insurers, and clearing houses. Not banks.
    – Xander
    Commented Jan 28, 2016 at 16:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .