Email, Messaging and End-to-End Encryption

Email is the master key of your online life, because every "forgot my password" link ends up there. It is also the favorite delivery channel of fraudsters. In this lesson you will learn to read a suspicious email like an investigator, protect your mailbox, and understand what "end-to-end encryption" in a messaging app really means.

Lesson 1.1 gave you a basic reflex for phishing. Here we go deeper into what an email actually contains and how to analyze it calmly. We will also look at who can read your messages in transit, which is what encryption is all about.

Anatomy of an email

An email is not just the body you see. It has parts that you can inspect:

• Display name: the friendly name shown in the sender field. It is a free-text label, and anyone can set it to anything.
• Sender address: the real address behind the name. Check its domain just as you did for web addresses.
• Reply-To address: where your reply will go, which can differ from the sender. Fraudsters use this to receive your answer.
• Subject and body: what the attacker wants you to read.
• Links: the visible text of a link can differ from where it leads.
• Attachments: documents, archives, images or programs.
• Technical headers: hidden details about the path of the message, which specialists use for investigation.

Email was invented at a time when everyone on the network was trusted, so it does not natively prove who the sender is. Providers add checks (known by acronyms such as SPF, DKIM and DMARC) to detect forged senders. They help a lot, but they are not perfect: a criminal can simply register a similar-looking domain and pass all of them. That is why you must still look at the content.

A calm method to analyze a suspicious email

1. Pause and check the context. Were you expecting it? Does the request fit the usual way this organization communicates?
2. Check the real sender address and compare the domain with the real one.
3. Look at the greeting and the wording. Generic greetings, odd phrases or an unusual tone from someone you know are clues, though well-written phishing exists.
4. Inspect the links without clicking. Hover or long-press to display the destination.
5. Be careful with attachments, especially unexpected ones: archives (.zip), documents asking to "enable editing" or "enable content", and files with double extensions such as invoice.pdf.exe.
6. Evaluate the request. Money, credentials, codes, urgent secrecy: stop and verify through another channel.
7. Report and delete. Use your mailbox's "report phishing" function, which helps the provider protect everyone. In France you can also report suspicious messages through the official channels listed on cybermalveillance.gouv.fr; most countries have an equivalent.

Other email traps

• Conversation hijacking: an attacker who has compromised a mailbox replies inside a genuine existing thread, which looks very credible. If the request is unusual, verify by phone.
• Fake "shared document" notifications that lead to a fake login page.
• Tracking pixels: invisible images in marketing emails that tell the sender you opened the message. Many mail apps can block remote images by default.
• Unsubscribe links in spam: in genuine newsletters, unsubscribing is fine. In obvious spam, clicking confirms that your address is active, so just delete or report it.

Protecting your mailbox

• Protect your email account with a unique passphrase and a strong second factor, ideally a passkey or a security key. It is the most important account to protect.
• Check the recovery options: the recovery email address and phone number must be up to date and also secured.
• Review forwarding rules and filters from time to time. A classic attacker trick is to add a hidden rule that forwards or hides your messages.
• Review the devices and apps connected to your mailbox and remove those you do not recognize.
• Use separate addresses: one for critical accounts (bank, administration), one for everyday use, and one for newsletters and sign-ups. This limits the damage from leaks and makes phishing easier to spot, because a message from your "bank" arriving at the newsletter address is obviously wrong. Many providers offer aliases for this purpose.

Who can read your messages?

Encryption in communication comes in two main forms, which people often confuse:

• Encryption in transit: the message is encrypted between your device and the provider's server, and between servers. It protects against someone listening on the network. The provider, however, can read the message, because it holds the keys. This is the situation for most regular email.
• End-to-end encryption (E2EE): the message is encrypted on the sender's device and can only be decrypted on the recipient's device. Nobody in between, including the service provider, can read it. Think of a letter in a safe that only you and the recipient can open, carried by a courier who never gets the combination.

Many modern messaging apps use end-to-end encryption by default for personal conversations, and some email systems offer it as an option. Regular email, though, is generally not end-to-end encrypted: treat it as a postcard that only the right people are supposed to read.

What E2EE does and does not do

• It does protect the content of messages from interception on the way and from the provider.
• It does not hide metadata, such as who talks to whom and when, to the same extent. Some services collect it.
• It does not protect a message once it arrives on a compromised phone, or from someone looking over your shoulder, or from a recipient who shares or screenshots it.
• It does not stop scams: a fraudster can message you on an encrypted app too. A secure channel is not a trusted sender.
• Cloud backups of conversations may or may not be encrypted in the same way. Check the settings if your conversations are sensitive.

Some apps let you verify the security of a conversation by comparing a code or scanning a QR code with your contact, in person or by another channel. This protects against rare but serious interception attacks. It is optional for everyday chats and valuable for sensitive ones. Features like disappearing messages can also help limit what remains on devices.

Your turn

Exercise. Review the security of your main email account using this checklist: second factor, recovery information, forwarding rules, connected apps and recent sign-in activity. Fix what is missing.

See a solution

1. Second factor: enable the strongest method available (passkey or security key, then authenticator app, then SMS).
2. Recovery information: confirm that your recovery address and phone number are yours and current. Remove old ones.
3. Forwarding and filters: open the mail settings. Delete any forwarding rule or filter you did not create, and any rule that moves messages to hidden folders.
4. Connected apps and devices: revoke access for any app or device that you do not recognize or no longer use, and sign out of all other sessions.
5. Sign-in activity: look at the recent activity page, and investigate unknown locations or devices. If anything looks wrong, change the password immediately.

Add to your Security Notebook

Under "4. Browsing and communication", write your email analysis checklist in four lines, the list of addresses you use for different purposes, and the messaging apps you use for private conversations.

Finally, many of the things attackers use against you come from what you yourself publish. Let us look at social networks and your digital footprint.