I work for a government organization that sends monthly payments to our users/clients. One of our security practices is to suspend a user's payment if we receive three pieces of returned mail (regardless of whether the payment is mailed cheque or direct deposit). I've been asked to rework a templated email we send asking these users to update their mailing address. I'm struggling to find wording that doesn't sound like a phishing attempt. We have had users who received the original email contact us to ask if it's phishing.
Some of the specific questions I have:
- If I want to direct users to sign in to their account to update the mailing address, should I include a hyperlink to our website or include the website address as plain text?
- Should I include the organization's contact information (phone and mailing address)?
- How do I best convey to the user that their payments will be suspended if they don't update their information?
- How much of the user's personal information (full name, current mailing address, ID number) is it appropriate to include in the email?
Note: I don't have the authority to change our practices, only to suggest improved email wording.