Secure handling of email

No confidentiality

In terms of discretion, confidentiality, and security, an email is like a postcard. As with the postcard, anyone with access to the "mail path" between you and the target mailbox can potentially read emails received or sent.

Therefore, confidential data should never be included in an email that is not explicitly secured.

Malware in emails

Malware emails are emails with attachments that contain malware. Malware is often hidden in Zip, PDF, or DOC files.

Phishing: password theft

These emails almost look like messages from ETH or other trusted partners. However, links contained in the email lead to a plagiarism of the original website, where an attempt is made to steal your login data.

Scam or fraudulent emails: fraud

With such emails, attackers try to gain a financial advantage.

The victim receives an email, allegedly from a superior or a VIP. In the email, the victim is asked to deal with an "emergency", an exceptional situation, urgently and, for example, to transfer certain amounts quickly, to grant access rights or to provide information.

Due to the pressure built up by the supposed superior, the victims often fail to critically question the order, whether the sender's address is correct, and the order is plausible.

Mail spoofing: fake sender addresses

It is not difficult to fake sender addresses of emails in order to then - supposedly in the name of the faked sender - start fraud attempts. Be it via scam mails or phishing, or by sending attachments with malicious software. Sometimes the fake sender addresses look deceptively real.  

• Check the recipient list before clicking the send button.
• Be aware: After sending, you have no control over your emails. You don't know if they are copied and/or forwarded.
• If you have several recipients, use the address field "BCC" (English for Blind Carbon Copy) instead of "CC" if you do not want the remaining recipient addresses to be visible to everyone.
• Do not forward chain mails.
  

Confidential information may only be sent by email if it is encrypted. There are different ways to do this:

• Send confidential information in a password-protected ZIP archive as an attachment to the actual email.
  Transmit the password via different channel, e.g. by SMS.
• If you and the recipient have a certificate for email encryption, use them for "end-to-end encryption".
• If you are sure the transport connection to the target system is encrypted and if transport encryption is sufficient for you, you can send the email without additional measures.
  

• Check the return address: Does it match the name displayed?
• Distrust emails you receive unsolicited and which come from unknown sources or persons.
• If you suspect that an unjustified request has been sent to you by email, reject it or contact the alleged sender by phone. Talk to your IT specialists if you are unsure.
• Do not click on links or open attachments in suspicious emails.
• Do not open "exe" files and other executable file formats. Be careful with all other file attachments, especially if you don't know the sender.
• Does the Word document you just received contain a macro and a prompt to activate it in order to view the document? Do not do this under any circumstances.
• If an email seems suspicious to you, do not hesitate to ask your ISG or ID Service Desk.
• If you receive many suspicious emails at once, please inform your IT support as soon as possible.