Emailing users to request an updated mailing address

Question

I work for a government organization that sends monthly payments to our users/clients. One of our security practices is to suspend a user's payment if we receive three pieces of returned mail (regardless of whether the payment is mailed cheque or direct deposit). I've been asked to rework a templated email we send asking these users to update their mailing address. I'm struggling to find wording that doesn't sound like a phishing attempt. We have had users who received the original email contact us to ask if it's phishing.

Some of the specific questions I have:

• If I want to direct users to sign in to their account to update the mailing address, should I include a hyperlink to our website or include the website address as plain text?
• Should I include the organization's contact information (phone and mailing address)?
• How do I best convey to the user that their payments will be suspended if they don't update their information?
• How much of the user's personal information (full name, current mailing address, ID number) is it appropriate to include in the email?

Note: I don't have the authority to change our practices, only to suggest improved email wording.

Answer 1

This is a tricky message to convey, since phishing is commonly characterized by an urgent prompt to take action, accompanied by fraudulent hyperlinks.

The more information the email can contain to legitimize the source, the better. Therefor definitely include the organization's contact details, as well as motivation for sending the email - three pieces of returned mail. Also consider adding the address to where the mail was sent to.

Including a hyperlink is risky. Having it present in the email can make it seem like a phishing attempt, whereas excluding it from the email removes that rationale.

If this is a regular occurrence, consider adding some kind of confirmation to your website. When a skeptical user sees general information about the subject on your actual website, they will be reassured.

Answer 2

I agree with @Marné, this is an awkward situation but no hyperlink should be added into the email, and more info is provided about the organization more the trust/action by the users/clients you will get.

Contacts are usually written down into the footer of the mailing, but to reassure more the users you can add those also into the body. Anyway, providing all the info about the sender, how to contact them, let the users know that someone will answer their questions/doubts.

Moreover, If I understood well, you are restyling only the messages of this template and not the layout, therefore (I suppose) the users should be already familiar with it and will go ahead to read the request.

Try to explain/motivate the request to up to date the email address as needed by the TOS (Term of Services) of your organization. The risk if it's not done within the due time (suspension of payments service provided). Quote the TOS into the email or explain how to get it from the main website (eg. homepage > right-bottom of page > Term of Services) without writing down the hyperlink.

Talking about of a government's organisation, that handle personal data of their users and providing payments services, should have an HTTP(S) security website (I reckon), and this will help you to reassure the users/clients to follow the instructions to up to date the mailing address.

All the info that is allowed to be added by contract and to let the users/clients be sure that is not a phishing, but I would stay plain to avoid issues.