How safe is email?

Nebbit

Many thanks for the encouraging replies  

Brie

Easier to commit fraud with a cheque that has been intercepted than with bank details sent by email in my opinion.  

First off you need to know that an email has the bank details in it so other than large corporations that ship this info out every day there's little threat.  If my gardener sends me bank details I can easily check that they are from him and deal with it all appropriately.

But when I used to work for a large company that sent out thousands of cheques every week we knew that a surprisingly large number were intercepted and "washed".  Ok so large is a relative thing but say 10 cheques were intercepted each week.  When washed the name of the recipient was changed and the amount, leaving the signature and everything else as normal.  So a payment of £8.32 for Bob Smith magically was being cashed by Barb Jones for £4832.59.  A very few would get caught by the bank about to pay out to "Barb" but the rest went through.  Very expensive! 

debitcardmayhem

km1500 said:

so you are saying that if I send an email from my Fred@gmail.com to Joe@gmail.com it can be intercepted and eg read before it arrives at Joe?

Yes it can be intercepted before it gets on to the internet 

Nebbit

The person I am sending to is trustworthy, I was just thinking of the dangers of interception. But my mind is at rest now

400ixl

km1500 said:

so you are saying that if I send an email from my Fred@gmail.com to Joe@gmail.com it can be intercepted and eg read before it arrives at Joe?

Extremely unlikely for a service like Gmail which would not likely to be misconfigured to allow DNS MX attacks, but if it were joe@bloggs.co.uk then maybe.

More likely in this scenario would be that Joe uses the same email and password for many web sites and if one of those other sites was hacked they can just log in to his gmail email address and password.

km1500

thanks for the information 

logging on to his email account because you have his credentials it's not interception as the message has already arrived

twopenny

I think it's much the same as if you buy something on the internet from a supplier you don't know. You give them some card details.

I just always stay alert and check my bank account for a while to be sure the correct amount etc has been taken.

Not sure I'd send my banking details to anyone.

username

RumRat said:

Lost count of the number of business' that have sent me emails with bank details for payment contained as part of the signature or header.
What can someone do with the details other than pay something into your account???

Years ago it is said that Jeremy Clarkson published his bank details in a tabloid newspaper and had a number of spurious direct debits attached to it, so depending on the type of account you can have such things happen.

One thing that's forgotten to be mentioned is that if this is part of a commercial transaction (ie. buying a house, or dealing with tradesmen wanting to be paid or something involving significant sums of money) is to always be wary if they specify different bank details to be paid into from what is agreed, and always if you've any doubt do not hesitate to confirm with the other party via a recognised phone number (such as one on an previous invoice/advert, their website etc) that the bank details are correct before paying.

It's been known for the businesses' email to be hacked into, and email trails intercepted so that any bank details are changed to that of the fraudsters and some pretence used to explain the change of bank details using some cover story, the payee loses their money as a result.

Murmansk

The IT worker at the charity I worked for told us in no uncertain terms that emails were not a suitable way of exchanging messages involving confidential client data and that they should only be sent in an encrypted form - and that failure to do this might result in a massive fine from the Information Commissioner's Office. 

eddddy

username said:

Years ago it is said that Jeremy Clarkson published his bank details in a tabloid newspaper and had a number of spurious direct debits attached to it, so depending on the type of account you can have such things happen.

As you say, in 2008, Jeremy Clarkson published his bank account details in The Sun, and a prankster set up a direct debit for £500 payable to the charity Diabetes UK.

(I imagine the prankster put the bank details into a form on the charity's website, or phoned the charity and gave the bank details over the phone.)

Clarkson could have complained to his bank under the Direct Debit Guarantee, and the money would have been immediately refunded to Clarkson, while the bank investigated.


(And organisations have to prove their credentials before they can collect funds by direct debit - so it would be difficult for a fraudster to be approved for collecting funds by direct debit.)