Email is a postcard, not a sealed letter. I run AliasFleet, an email-alias service, and that is the mechanism behind everything on this list: every message you send rests readable on servers you will never see, copied into backups, forwarded threads, and inboxes you do not control. Some things should never go through that channel, and the eight below are the worst offenders.
What happens to your mail after you hit send
Your provider reads it. Google ended Gmail ad personalisation scanning in 2017, but its terms still let automated systems analyse what you send, receive, and store. Spam filtering and malware detection need that access, and so does anyone with a warrant. So did whoever breached the provider: the August 2013 Yahoo breach eventually reached all 3 billion accounts, and every old email sitting in Yahoo's archives went along for the ride.
The trip there is not sealed either. SMTP was built as cleartext, and the STARTTLS bolt-on asks the receiving server whether it supports encryption, then silently falls back to plaintext when the answer is no, or when an attacker strips the question out of the conversation. DigiCert's STRIPTLS write-up walks through the downgrade; APNIC's 2024 audit shows it in practice. Google's own transparency numbers, cited in that audit, put about 2 percent of Gmail's outbound mail in the unencrypted bucket. Two percent of Gmail is a mountain of postcards.
Have I Been Pwned currently lists 1,047 breached sites and more than 17.8 billion exposed addresses (haveibeenpwned.com). If your address is ten years old, assume your sent folder has been photocopied. The items below are the ones where the photocopy hurts.
1. Passwords
Day one. The new hire needs the Wi-Fi password, so you email it to her. Ten years later it is still sitting in your sent folder, in her inbox, and in the backups of both providers, on terms neither of you chose.
When either side is breached, that address plus password joins the lists feeding credential stuffing: automated login attempts replayed against banks, shops, and inboxes while the attacker sleeps. Nobody sends one password by email. They send them for years and forget every one.
Share credentials through a password manager's shared vault instead, or an encrypted one-time secret link that burns after a single read. If someone emails you a password, change it the moment it works, then delete the message. If you have ever emailed one to yourself "for safekeeping", change it now. Your inbox is the master key to every account you own, which is why this one matters more than the rest.
2. One-time codes
The code lands in the same inbox that receives your password resets. NIST treats that as a structural failure: under SP 800-63B, email is not a valid out-of-band channel, because an inbox is an account you can reach from anywhere. Avatier's 2026 walkthrough of the standard puts it bluntly. An emailed code usually collapses the second factor back into "something you know".
Where a site offers an authenticator app or a passkey, take it. Where email codes are the only option, switch them on anyway, because a weak second factor still beats none, and hand that site a per-site alias so the code lands somewhere other than your main address. The full ranking of email codes against stronger factors is a separate deep dive.
3. ID scans and identity documents
The letting agent replies with the line everyone has heard a hundred times: just email over a scan of your passport. Landlords, employers, hotels, and visa agents all ask, and everyone complies. That scan then sits in two inboxes and their backups, searchable forever. Paired with the name and address already in the thread, it is most of an identity-theft kit in a single file. The full chain is ugly: one leaked document to fraudulent accounts.
Use the recipient's secure upload portal where one exists. Where it does not, an encrypted share link that expires beats an attachment, because the file never takes up permanent residence in two email archives. For the highest-stakes documents, verify in person. A passport scan in an email should feel as wrong as it is.
4. Bank and card numbers
A supplier emails: send your card details to hold the order. The number you type out lands in your sent folder for good, and the recipient's copy drags their environment into the same compliance problem. One breached inbox on either side and the number is in a dump. Stripe's PCI DSS checklist states it as a flat rule: "Never send card numbers over email or unencrypted channels." (source)
Use the bank's secure messaging inside its own app, a compliant payment link, or the phone. Call a number you found yourself on the bank's own site, and read the details out. Never send them to a number or address that contacted you first. If a business asks for card details by email, that request tells you everything about how they handle data. Pay someone else.
5. Wire instructions and payment changes
The most expensive item on this list. The standard move in business email compromise: a message, often from a spoofed or compromised account, carrying "updated bank details" or "new wire instructions". The victim sends a real payment to the attacker's account. The money is gone before anyone checks. In 2024 the FBI's Internet Crime Complaint Center logged 21,442 of these complaints, with losses close to $2.8 billion (via Nacha's summary of the IC3 report).
The rule is absolute. Confirm every payment instruction by voice, on a number you already had, before money moves. Treat any emailed change of account details as hostile until a human voice you recognise says otherwise. House purchases, supplier invoices, salary payments: no exceptions. The post-breach phishing playbook is the same forgery in different clothes: content you were told to expect, arriving through a channel you cannot verify by reading.
6. Your real email address
This one surprises people. Your address is the one identifier that appears in nearly every breach file. Hand it to a hundred sites and a hundred databases hold the string that ties your accounts together. The journey a signup address takes after you submit runs through trackers, ad platforms, data brokers, and eventually someone's breach dump.
Where a site does not need your real address, hand it a dedicated email alias instead. One alias per site means the next breach exposes an address that belongs to that site alone, and you pause it in one click. That is the one-address-per-site habit; the set-up guide takes a couple of minutes. The limit belongs in the same breath: an alias changes who holds your address, not how email works. Aliased mail travels the same postcard channel as everything else.
7. Private photos and videos
Open your sent folder and scroll back. Years of private photos are sitting there, in sent threads and received threads, on both ends. An account takeover exposes all of it, not just new mail, and every forwarded copy made another one you will never find. If that sentence made your stomach drop, check whether the old address is already circulating.
For anything you would not publish, use end-to-end encrypted messaging, where the provider cannot read the content at rest and no searchable server-side archive waits to be breached. The archive is the feature that makes email dangerous here. The same system that keeps your receipts findable keeps everything else findable too.
8. Health records and test results
Lab results, diagnoses, prescriptions, insurance claims. In the US, the HIPAA Security Rule only lets providers send health data to patients by unencrypted email after warning them of the risk and getting their agreement (Holland and Hart's HIPAA email analysis walks through the HHS position). Your own emails carrying health data get none of that protection. They sit in inboxes that employers, insurers, and attackers would all find interesting.
Use the patient portal. Clinics, labs, and insurers all run them now, and they exist precisely because email is the wrong channel. If a provider insists on email for health documents, ask for the portal or an encrypted alternative before you comply.
The postcard test
Before you send anything on this list, run the postcard test: imagine the message printed out and readable by everyone who handled the servers between you and the recipient. If that is fine, send it; if it is not, use the alternative from the table.
| Never send this by email | Send it this way instead |
|---|---|
| Passwords | Password manager shared vault, one-time secret link |
| One-time / 2FA codes | Authenticator app, passkey |
| ID scans and identity documents | Secure upload portal, expiring share link, in person |
| Bank and card numbers | Bank app secure messaging, compliant payment link, phone call you initiated |
| Wire instructions and payment changes | Verbal confirmation on a known number, every time |
| Your real email address | A dedicated alias per site |
| Private photos and videos | End-to-end encrypted messaging |
| Health records and test results | Patient portal, encrypted email service |
You cannot un-send the mail that is already out there. You can still contain what comes next. Work through the breach-response checklist, lock the inbox itself down hard, and stop handing new sites the address that is already everywhere (the honest answer on giving your email to websites). The postcard system is not going away. What you write on the postcard is still your call.
