1

I work for a government organization that sends monthly payments to our users/clients. One of our security practices is to suspend a user's payment if we receive three pieces of returned mail (regardless of whether the payment is mailed cheque or direct deposit). I've been asked to rework a templated email we send asking these users to update their mailing address. I'm struggling to find wording that doesn't sound like a phishing attempt. We have had users who received the original email contact us to ask if it's phishing.

Some of the specific questions I have:

  • If I want to direct users to sign in to their account to update the mailing address, should I include a hyperlink to our website or include the website address as plain text?
  • Should I include the organization's contact information (phone and mailing address)?
  • How do I best convey to the user that their payments will be suspended if they don't update their information?
  • How much of the user's personal information (full name, current mailing address, ID number) is it appropriate to include in the email?

Note: I don't have the authority to change our practices, only to suggest improved email wording.

  • Just to clarify, @Heather is reworking an email that will be sent to users whose snail mail has been returned. – Maigen Thomas Oct 2 '18 at 22:26
1

This is a tricky message to convey, since phishing is commonly characterized by an urgent prompt to take action, accompanied by fraudulent hyperlinks.

The more information the email can contain to legitimize the source, the better. Therefor definitely include the organization's contact details, as well as motivation for sending the email - three pieces of returned mail. Also consider adding the address to where the mail was sent to.

Including a hyperlink is risky. Having it present in the email can make it seem like a phishing attempt, whereas excluding it from the email removes that rationale.

If this is a regular occurrence, consider adding some kind of confirmation to your website. When a skeptical user sees general information about the subject on your actual website, they will be reassured.

  • I really like the idea of adding confirmation to the website. It's an appropriate way to convey that it's - for lack of a better word - legit. Perhaps a page they can visit for more details is blah.blahblah.gov/addresschange or something that can be added (without being hyperlinked) to the email to verify the legitimacy and assure the user that the request for the change of address is not fraudulent. – Maigen Thomas Oct 2 '18 at 22:30
1

I agree with @Marné, this is an awkward situation but no hyperlink should be added into the email, and more info is provided about the organization more the trust/action by the users/clients you will get.

Contacts are usually written down into the footer of the mailing, but to reassure more the users you can add those also into the body. Anyway, providing all the info about the sender, how to contact them, let the users know that someone will answer their questions/doubts.

Moreover, If I understood well, you are restyling only the messages of this template and not the layout, therefore (I suppose) the users should be already familiar with it and will go ahead to read the request.

Try to explain/motivate the request to up to date the email address as needed by the TOS (Term of Services) of your organization. The risk if it's not done within the due time (suspension of payments service provided). Quote the TOS into the email or explain how to get it from the main website (eg. homepage > right-bottom of page > Term of Services) without writing down the hyperlink.

Talking about of a government's organisation, that handle personal data of their users and providing payments services, should have an HTTP(S) security website (I reckon), and this will help you to reassure the users/clients to follow the instructions to up to date the mailing address.

All the info that is allowed to be added by contract and to let the users/clients be sure that is not a phishing, but I would stay plain to avoid issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.