The basic answer is [SMTP](https://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol). HTTPS is only a consideration on the 'last mile', if you will - between the end user and the mail client. In order for the mail client to 'see' the mail, it first needs to be sent between hosts via SMTP. When your bank sends an unencrypted email to your Gmail address, anyone able to see traffic on the network between your bank's email server and their next relay/hop in the mail path can see the full contents (i.e. Google's server). There is a long list of who that could be. It could include local staff at the bank, third parties providing e.g. security monitoring to the bank's network, and so on.