I'm in the middle of getting a mortgage. Just now, my bank sent over an e-mail (sent to my Gmail account) with a bunch of .pdf attachments of documents I'm supposed to sign and return. The first thing I noticed is that many of these .pdf files were pre-populated with my personal information. The .pdf files were not encrypted or password protected.
All sorts of personal information was in the documents - not just my SSN by my name/DOB/address/bank account numbers/etc/etc....
Before I go off the deep-end here, can we just confirm that there is no such thing as a
secure e-mail with unencrypted text/attachments? My understanding is that, best case scenario - they used TLS/SSL and it was encrypted in transit but that the encryption would only be between the sender and Google's server. So, somewhere, at one of Google's data farms, there is a .pdf with all of my personal information in it, that is not encrypted or protected. Does that sound about right?
In the message headers I can see
Received...by mx.google.com with ESMTPS id.....(version=TLS1_2...)
So it seems it was sent with TLS, which is good. But are the attachments/visible to my mail provider?