https://danq.me/2026/01/28/hsbc-dont-understand-email/ Skip to content * Blog + Articles + Everything + Notes + Reposts (shares) + Checkins (geo*) + Videos + Reviews + Comics + Tags + Stats + Subscribe + Blogroll * About + Polyamory + Volunteering + Colophon + A Eulogy for Peter George Huntley * Contact + Contact Me + Postcards From The Internet! + Instant Messengers + GPG Key * Projects + Free Deed Poll + KeePass for Opera + mOTP for Ruby + PicInHTML + Rails SSL Auth + Dozens of other projects... That's Not How Email Works, HSBC I have a credit card with HSBC^1. It doesn't see much use^2, but I still get a monthly statement from them, and an email to say it's available. Not long ago I received a letter from them telling me that emails to me were being "returned undelivered" and they needed me to update the email address on my account. "What's happening?" Posted letter from HSBC saying that emails to me have been returned undelivered, held in front of a screen showing a recent email from HSBC sitting in my Inbox. I don't know what emails are being "returned undelivered" to HSBC, but it isn't any of the ones sitting, read, in my email client. I logged into my account, per the instructions in the letter, and discovered my correct email address already right there, much to my... lack of surprise^3. So I kicked off a live chat via their app, with an agent called Ankitha. Over the course of a drawn-out hour-long conversation, they repeatedly told to tell me how to update my email address (which was never my question). Eventually, when they understood that my email address was already correct, then they concluded the call, saying (emphasis mine): I can understand your frustration, but if the bank has sent the letter, you will have to update the e-mail address. This is the point at which a normal person would probably just change the email address in their online banking to a "spare" email address. But aside from the fact that I'd rather not^4, by this point I'd caught the scent of a deeper underlying issue. After all, didn't I have a conversation a little like this one but with a different bank, about four years ago? Phone screen showing a live chat interface. The other party says "I can understand your frustration, but if the bank has sent the letter, you will have to update the e-mail address." and then "Thank you for being so understanding and patiently waiting. Thank you for contacting HSBC, if there is anything else you need please feel free to come back to us. Have a pleasant rest of the day.", before ending the conversation. Perhaps I should be grateful that they didn't say that I have to change my name, which can sometimes be significantly more awkward than my email address... So I called Customer Services directly^5, who told me that if my email address is already correct then I can ignore their letter. I suggested that perhaps their letter template might need updating so it doesn't say "action required" if action is not required. Or that perhaps what they mean to say is "action required: check your email address is correct". Edited version of the letter, now saying 'What's happening? We need to ensure that the email address we're using for you is correct' and 'Action required: Please check that you've been receiving our emails and that the address in your account is correct'. Say what you mean, HSBC! I've suggested an improvement to your letter template. So anyway, apparently everything's fine... although I reserved final judgement until I'd seen that they were still sending me emails! "Action required" I think I can place a solid guess about what went wrong here. But it makes me feel like we're living in the Darkest Timeline. Scene from Community episode 'Remedial Chaos Theory'. Pierce lies injured on the floor, tended to by Annie and Abed, while Jeff swings a flaming blanket around his head. Troy stands in shock at the door, holding a pile of pizza boxes. You know the one I mean. Somebody rolled a '1', didn't they... I dissected HSBC's latest email to me: it was of the "your latest statement is available" variety. Deep within the email, down at the bottom, is this code: What you're seeing are two tracking pixels: tiny 1x1 pixel images, usually transparent or white-on-white to make them even-more invisible, used to surreptitiously track when somebody reads an email. When you open an email from HSBC - potentially every time you open an email from them - your email client connects to those web addresses to get the necessary images. The code at the end of each identifies the email they were contained within, which in turn can be linked back to the recipient. You know how invasive a read-receipt feels? Tracking pixels are like those... but turned up to eleven. While a read-receipt only says "the recipient read this email" (usually only after the recipient gives consent for it to do so), a tracking pixel can often track when and how often you refer to an email^6. If I re-read a year-old email from HSBC, they're saying that they want to know about it. But it gets worse. Because HSBC are using http://, rather than https: // URLs for their tracking pixels, they're also saying that every time you read an email from them, they'd like everybody on the same network as you to be able to know that you did so, too. If you're at my house, on my WiFi, and you open an email from HSBC, not only might HSBC know about it, but I might know about it too. An easily-avoidable security failure there, HSBC... which isn't the kind of thing one hopes to hear about a bank! Zoom-in animation showing two tracking pixels at the bottom of an email, rendered visible in red and blue. Tracking pixels are usually invisible, so I turned these ones visible so you can see where they hide. But... tracking pixels don't actually work. At least, they doesn't work on me. Like many privacy-conscious individuals, my devices are configured to block tracking pixels (and a variety of other instruments of surveillance capitalism) right out of the gate. This means that even though I do read most of the non-spam email that lands in my Inbox, the sender doesn't get to know that I did so unless I choose to tell them. This is the way that email was designed to work, and is the only way that a sender can be confident that it will work. But we're in the Darkest Timeline. Tracking pixels have become so endemic that HSBC have clearly come to the opinion that if they can't track when I open their emails, I must not be receiving their emails. So they wrote me a letter to tell me that my emails have been "returned undelivered" (which seems to be an outright lie). Surveillance capitalism has become so ubiquitous that it's become transparent. Transparent like the invisible spies at the bottom of your bank's emails. The letter from HSBC again, but this time corrected to say 'We cannot conceive that there's anybody left who hasn't given up on trying to fight back against surveillance capitalism. Action required: turn off your privacy software so we can watch you read our emails. (We'll be letting anybody you live with read them too.) I've changed my mind. Maybe this is what HSBC's letter should have said. So in summary, with only a little speculation: 1. Surveillance capitalism became widespread enough that HSBC came to assume that tracking pixels have bulletproof reliability. 2. HSBC started using tracking pixels them to check whether emails are being received (even though that's not what they do when they are reliable, which they're not). + (Oh, and their tracking pixels are badly-implemented, if they worked they'd "leak" data to other people on my network^7.) 3. Eventually, HSBC assumed their tracking was bulletproof. Because HSBC couldn't track how often, when, and where I was reading their emails... they posted me a letter to tell me I needed to change my email address. What do I think HSBC should do? Instead of sending me a misleading letter about undelivered emails, perhaps a better approach for HSBC could be: 1. At an absolute minimum, stop using unencrypted connections for tracking pixels. I do not want to open a bank email on a cafe's public WiFi and have everybody in the cafe potentially know who I bank with... and that I just opened an email from them! I certainly don't want attackers injecting content into the bottom of legitimate emails. 2. Stop assuming that if somebody blocks your attempts to spy on them via your emails, it means they're not getting your emails. It doesn't mean that. It's never meant that. There are all kinds of reasons that your tracking pixels might not work, and they're not even all privacy-related reasons! 3. Or, better yet: just stop trying to surveil your customers' email habits in the first place? You already sit on a wealth of personal and financial information which you can, and probably do, data-mine for your own benefit. Can you at least try to pay lip service to your own published principles on the ethical use of data and, if I may quote them, "use only that data which is appropriate for the purpose" and "embed privacy considerations into design and approval processes". 4. If you need to check that an email address is valid, do that, not an unreliable proxy for it. Instead of this letter, you could have sent an email that said "We need to check that you're receiving our emails. Please click this link to confirm that you are." This not only achieves informed consent for your tracking, but it can be more-secure too because you can authenticate the user during the process. Also, to quote your own principles once more: when you make a mistake like assuming your spying is a flawless way to detect the validity of email addresses, perhaps you should "be transparent with our customers and other stakeholders about how we use their data". Wouldn't that be better than writing to a customer to say that their emails are being returned undelivered (when they're not)... and then having your staff tell them that having received such an email they have no choice but to change the email address they use (which is then disputed by your other staff)? Footnotes ^1 You know, the bank with virtue-signalling multiculturalism that we used to joke about. ^2 Long, long ago I also had a current account with HSBC which I forgot to close when I switched banks... 20 years ago... and I possibly still owe them for the six pence the account was in debt at the time. ^3 After all, I'd been reading their emails! ^4 After all, as I'll stress again: the email address HSBC have for me, and are using, is already correct. ^5 In future, I'll just do this in the first instance. The benefits of live chat being able to be done "in the background" while one gets on with some work are totally outweighed when the entire exchange takes an hour only to reach an unsatisfactory conclusion, whereas a telephone call got things sorted (well hopefully...) within 10 minutes. ^6 A tracking pixel can also collect additional personal information about you, such as your IP address at the time that you opened the email, which might disclose your location. ^7 It could be even worse still, actually! A sophisticated attacker could "inject" images into the bottom of a HSBC email; those images could, for example, be pictures of text saying things like "You need to urgently call HSBC on [attacker's phone number]." This would allow a scammer to hijack a legitimate HSBC email by injecting their own content into the bottom of it. Seriously, HSBC, you ought to fix this. Posted letter from HSBC saying that emails to me have been returned undelivered, held in front of a screen showing a recent email from HSBC sitting in my Inbox. x Phone screen showing a live chat interface. The other party says "I can understand your frustration, but if the bank has sent the letter, you will have to update the e-mail address." and then "Thank you for being so understanding and patiently waiting. Thank you for contacting HSBC, if there is anything else you need please feel free to come back to us. Have a pleasant rest of the day.", before ending the conversation. x Edited version of the letter, now saying 'What's happening? We need to ensure that the email address we're using for you is correct' and 'Action required: Please check that you've been receiving our emails and that the address in your account is correct'. x Scene from Community episode 'Remedial Chaos Theory'. Pierce lies injured on the floor, tended to by Annie and Abed, while Jeff swings a flaming blanket around his head. Troy stands in shock at the door, holding a pile of pizza boxes. x Zoom-in animation showing two tracking pixels at the bottom of an email, rendered visible in red and blue. x The letter from HSBC again, but this time corrected to say 'We cannot conceive that there's anybody left who hasn't given up on trying to fight back against surveillance capitalism. Action required: turn off your privacy software so we can watch you read our emails. (We'll be letting anybody you live with read them too.) x 28 January 2026 Article posted at 06:38 UTC on 28 January 2026. * Previous article * All articles * More from January 2026 * More from 2026 * On this day in: 2024 2020 2019 2018 2017 2013 2009 2004 6 tags This post is tagged: * banks * creepy * email * hsbc * privacy * rant 7 syndications This content can also be found on: * #@blog@danq.me * #facebook.com * #itsdanq * #scatmania * #tumblr.com * #finger://hsbc-dont-understand-email@danq.me * #@DanQBlog Share 1 mention * HSBCNao Wu Long :Jiang "Lan Jie Zhui Zong "Wu Pan Wei "You Jian Tui Hui ",Bao Lu An Quan Lou Dong HSBCNao Wu Long :Jiang "Lan Jie Zhui Zong "Wu Pan Wei "You Jian Tui Hui ",Bao Lu An Quan Lou Dong Reactions * 6 * 8 * 1 * 0 * 0 * 0 No time to comment? Send an emoji with just one click! 6 comments 1. Natalie Awdry Natalie Awdry says: This is crazy! 28 January, 2026, 10:50 2. Jan Jan says: Surveillance capitalism at it's finest indeed. But what is stopping you from "voting with your wallet" and moving to another less intrusive bank? 28 January, 2026, 19:09 1. Dan Q Dan Q says: This is the second bank I've caught doing exactly this; it's merely the first time I've bothered to write about it! So... there's nothing stopping me. In fact, I've already cleared and ceased using that credit card in anticipation of dropping it. And if I get the opportunity to explain why (when I close the account) then I'll include this as a reason. But my suspicion would be that most of them are just as bad, and I'm unwilling to just keep a stash of cash in a sock under my bed (lol), and even more-unwilling to pivot to (ick) cryptocurrency. But if you know of a bank with a more-ethical approach to customer privacy, let me know! 28 January, 2026, 19:15 3. Brad Choate Brad Choate says: > Instead of this letter, you could have sent an email that said "We need to check that you're receiving our emails. Please click this link to confirm that you are." I really hope banks don't do this, because such a thing would be too easy for phishing abuse. Look, they should be confirming an email address on sign-up (since it's in response to customer action, it would be an expected communication), and they can send a letter if future email messages are bouncing... that's how you know if an email address is no longer valid. Certainly a better signal to follow than a tracking pixel. But with respect to tracking pixels, mass email services have been doing this for years and is a basic expectation for monitor email campaign metrics... how many messages were sent, how many were delivered, how many were opened, how many clicks for links A, B, C, D. You'd be hard pressed to find any bank that isn't doing this (or any email newsletter, for that matter). The only way that would change is through privacy legislation. 28 January, 2026, 19:59 1. Dan Q Dan Q says: But with respect to tracking pixels, mass email services have been doing this for years and is a basic expectation for monitor email campaign metrics... Yeah, this is the same thing as I was saying to Jan: they're pretty ubiquitous nowadays. My problem is less with their use, but with their misuse. Tracking pixels were designed to collecting metrics: broad statistics on e.g. open rates. This was initially always done under the understanding that they were imperfect: there are so many reasons they produce false negatives (privacy-centric email clients like mine, primitive email clients, accessibility software) and several reasons they produce false positives (I was just recently looking at an issue where tracking pixels were being triggered by antispam software, before the email even reached a user's email account). That's why tracking pixels are only really useful as a broad statistical overview: approximately what proportion of users opened this email? That's how you use a tracking pixel. To misuse a tracking pixel, you take something that's only useful as a statistical amalgam and try to apply it to an individual. That's what HSBC did here: they said "this individual hasn't triggered our tracking pixel, therefore this individual isn't receiving our emails". Tracking pixels aren't a good choice for making that kind of decision. And then, to make matters worse, they outright lied about the situation, and their customer service agent doubled-down on that lie. Saying that my emails were being returned to them implied that they were being bounced or rejected by my mailserver, which simply wasn't the case. Then their agent said that I had to change my email address (which turns out to be untrue as well). Without even looking at the fact that they're using http:// addresses to address their tracking pixels, they're misusing them... not just technically but procedurally. I really hope banks don't do this, because such a thing would be too easy for phishing abuse. I'm unclear how it's any easier than using a tracking pixel for the same purpose. With a tracking pixel, it's like: if the user opens our email and loads a tracking pixel, we assume their email address is valid. With a confirmation link, it's like: if the user opens our email and clicks a confirmation link, we assume their email address is valid. These two both seem equivalent to me. Except that the latter works in places the former fails. But if I've misunderstood, let me know! 28 January, 2026, 20:40 4. Surveillance Capitalism Surveillance Capitalism says: I suspect this whole blog post is an excuse to say "surveillance capitalism" as many times as possible. 28 January, 2026, 22:27 Reply here Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] [ ] Name * [ ] Email * [ ] Website [ ] [*] Remember me? [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D [ ] Reply on your own site If you post a reply on your own site and it doesn't show up automatically, give me the link: [ ] [Ping me!] Reply elsewhere You can reply to this post on Mastodon (@blog@danq.me), LinkedIn. Reply by email I'd love to hear what you think. Send an email to b27343@danq.me; be sure to let me know if you're happy for your comment to appear on the Web! * (c) Dan Q 1998-2026 * Creative CommonsAttributionNon-Commercial except where stated ( how to use) * powered by BloqClassicPressHTML5CSS3 * privacy * Read # articles, # checkins, # notes, # reposts, and more... * # @dan@danq.me * # contact * #subscribe