I just got an email from a financial institution in answer to a question I raised with them. It came in the form of a "secure email" from Forcepoint, which requires you to open an HTML document and click on a link contained within. The document has an encrypted block of code in it which I presume is used in the process of creating the link / communicating with the remote server.
The link then gave me a registration form to fill in including a password and security question. I generated a random password and bogus answer for this purpose as I would always do.
After that I got another link by email which gave me the answer to my original question.
The whole process had a bad smell to it, including the dodgy-looking domain names involved ("voltage-pp-0000.secure-mailcontrol.com" - really?).
What's the security advantage of this, if any? Requiring you to click on an attachment seems like a really bad idea. I only followed the instructions because the context was such that I knew it was very unlikely to be a phishing attempt and none of the information asked for would be of any use if it were.