SecureMail FAQ

Security is a high priority for HSBC, especially when we are dealing with our customers and business partners' information.

It is HSBC's security policy to encrypt all e-mails that contain information which could pose a risk to our customers, business partners, clients or HSBC.

If there is already an agreement to use Pretty Good Protection (PGP) between HSBC and you, then we can continue to use PGP to encrypt your e-mails. In the future, we may migrate to only using Forced TLS and SecureMail; however, you will be advised of this in advance. If you wish to have your messages encrypted by Forced TLS or SecureMail, then please contact your HSBC relationship manager or HSBC representative.

Yes, but in due course we may migrate to only using Forced TLS and SecureMail when we need to send private or sensitive information to your personal or work e-mail address.

Exchanging messages by e-mail is one method of communicating securely with you. You will still receive messages through your normal online banking or other existing secure communication channels.

If mail from HSBC goes via a third-party processor which manages some or all aspects of your e-mail service, eg spam filtering or malware detection, then, if the mail has been encrypted by Forced TLS, we can only guarantee it gets to the third party (as that is where our connection ends). You or your relevant company representative should speak with your third-party e-mail processor if you would like to keep the information secure between them and you.

There is no requirement for a third party e-mail service company to be involved if the message has been sent encrypted by SecureMail as you only require your e-mail account, internet connection and access to a web browser to view your secure message.

If it is HSBC that initiates the message, then we will use Forced TLS if it is in place with you. TLS is fast becoming an industry standard and is now supported by the majority of mail server applications. Where Forced TLS is not in place with you, we will use SecureMail or an approved solution.

If you are intending to use your own e-mail encryption solution to initiate or reply to messages, then we request that you inform us of your solution in advance. Speak with your HSBC relationship manager or HSBC representative who will refer back to the relevant teams in HSBC. Please allow at least seven days for HSBC to assess the solution and its use within HSBC. Your relationship manager or HSBC representative will confirm the result and next steps.

HSBC takes information protection seriously, and it is against our security policy to send information insecurely if it could pose a risk to you or HSBC should it be intercepted by an unauthorised recipient.

We will only send you a secure e-mail if we are responding to a request or are required to send private or sensitive information which you prefer to receive by e-mail. Speak with your HSBC relationship manager or HSBC representative to discuss other secure information transfer channels that suit you if you do not wish to receive secure encrypted e-mails.

Transport Layer Security (TLS) is a mail server feature which, once enabled, encrypts the transmission of electronic mail from one organisation to another over the internet. Forced TLS is a configurable TLS policy setting which ensures the e-mail is only sent if the e-mail can be transmitted securely.

TLS is installed/configured on e-mail servers, and therefore, it is normally used by commercial/business organisations. TLS is fast becoming an industry standard and is now supported by the majority of mail server applications. HSBC has joined a growing number of organisations that have implemented it.

As TLS is an e-mail server function, it requires you or your company to be able to configure TLS on your mail server. If you are unable to do this, then we will not be able to use TLS with you. For example, if you use a web-based e-mail service, you will not be able to manage these e-mail servers.

If you use a third party to manage your e-mails, then you may be able to speak with them about establishing a TLS link between you and HSBC.

HSBC's preferred method of sending secure e-mail is by Forced TLS which will work if TLS is enabled at both the sender and recipient's e-mail servers. The correct server software is required to enable TLS, and you or your company may need to purchase new software if your current e-mail infrastructure does not support TLS. If your company is using a third party to manage your e-mail, then establishing TLS connections may need to be negotiated with your third party.

If HSBC is unable to arrange a Forced TLS with you, we will not be able to send the e-mail securely by TLS. In this case, HSBC will choose an alternative approved solution to send the information securely.

To send or receive e-mails securely via TLS, your e-mail server must be configured to accept TLS e-mail traffic. There may be a cost to you if either your current e-mail infrastructure does not support TLS and new software needs to be purchased or you need to pay for IT work to configure your existing software. Once the appropriate work has been done, the only ongoing cost will be for the yearly renewal of security certificates. You will not be charged per secure e-mail that you send or receive.

Once you have confirmation that TLS is enabled on your e-mail servers, please inform your HSBC relationship manager or HSBC representative who will follow our internal process and make the necessary arrangements. This process can take several days to allow for our IT team to complete implementation procedures and testing in conjunction with you or an IT representative from your company.

If you receive an e-mail encrypted by TLS, you will not need to take any specific action. The message will be delivered decrypted to your e-mail inbox like any other e-mail.

HSBC uses Forced TLS where possible to secure e-mails. Forced TLS guarantees the e-mail will be encrypted by TLS and sent securely. This means if TLS is not working the e-mail will not be sent. Please note this only applies to where Forced TLS is set up.

Where Forced TLS is set up, whenever a TLS connection cannot be established with you, the mail will not be sent, and we will receive a delivery failure message. We will first retry over a period of time in case of any temporary TLS problems or contact you to check whether you may be experiencing any TLS problems at your side. Further technical assistance may be required, and we will consult with our IT support desk for further advice.

Where Forced TLS is not in place, the e-mail will be encrypted by SecureMail or another approved solution.

I have received a SecureMail message but I can't find the message_zdm.html attachment referred to in my e-mail. What do I do?

Depending on your mail reader, the attachment will be placed on either the top or bottom of the e-mail. If you are still unable to find the attachment, please refer to the Mail Reader help section, which provides more information about opening the attachment on common e-mail applications.

How do I set up my SecureMail account?

You will be able to set up a SecureMail account when your HSBC relationship manager or HSBC representative sends you an e-mail for the first time using SecureMail. If your organisation already uses the SecureMail solution provided by Voltage, then you will not have to set up an account.

For a step-by-step guide to set up a SecureMail account, please see the SecureMail User Guide.

How do I read a secure e-mail sent via SecureMail?

To read your secure e-mail, download and open the message_zdm.html attachment. On the page that opens in your web browser, click the 'Sign in and Read Message' button.

If you already have an account, verify your e-mail address, and enter your password to sign into SecureMail. If you do not have an account, you can create one by following the instructions on the screen or seeing the SecureMail User Guide available at www.hsbc.com/secureemail. After you are logged in, the secure message displays in your web browser.

How do I access attachments sent to me in my secure message?

Once you are logged in and your message is displayed, you can open any attachment by clicking the View or Download links next to the attachment name. If the programme is known, the attachment is opened automatically; if not, the attachment opens in a new browser window. You may also be presented with a pop up box giving you options to open or save the attachment to your own network drive.

What does it mean if the signature on my SecureMail message is marked valid with a ?

Every secure e-mail is signed by the sender of the message to ensure authenticity of the sender and data integrity of the message. The means that the signature associated with this e-mail is valid and the message can be trusted.

What does it mean if the signature on my SecureMail message is marked invalid with a ?

Every secure e-mail message is signed by the sender of the message to ensure authenticity of the sender and data integrity of the message. The means that the signature associated with this message is not valid and the message may have been forged. We recommend that you contact your relationship manager or HSBC representative to check if the e-mail is genuine.

Can I read my e-mail encrypted by SecureMail on my smartphone?

SecureMail messages are designed to be read from desktop or laptop computers only. Depending on your phone browser, you may still be able to access the message from your smartphone; however, this is not recommended or supported by HSBC.

How do I reply to a secure e-mail?

You can reply to the originator of the message by:

1. Clicking 'Reply Secure' at the top of the secure message. This will take you to the reply screen. The originator's e-mail address is already entered in the 'To:' field. You will not be able to add any further names in the 'To:' field.
2. Type your reply. The original message is already included in the composition area.
3. Click 'Send Secure' to send your reply.

Please note that if you are sending a reply on behalf of your company, your normal company e-mail disclaimer will not be shown in the reply unless you insert it manually.

How do I add an attachment to my reply message in SecureMail?

 To add attachments to your reply:

1. Click 'Choose File...' in the 'Attach' field and select a file.
   The selected file is uploaded immediately.
2. To remove attachments, click 'Remove'.

How do I get a copy of the secure e-mail that I have composed?

To get a copy of your reply, click 'Send a Copy to my Inbox' to the right of the 'To:' field. When you send the message, an exact copy of your reply is sent securely to your e-mail account. If you decide you no longer wish to receive a copy, click 'Do not send a copy to my Inbox' to the right of the 'To:' field before sending the reply.

Can I use SecureMail whenever I want to communicate with you securely?

SecureMail enables you to reply to the originator of a secure message; however, for security reasons, you will not be able to compose or forward messages to HSBC or any other parties.

Can I forward my secure message to other parties?

For security reasons, you will not be able to forward messages to HSBC or any other parties.

What is SecureMail?

SecureMail is an e-mail encryption solution provided by Voltage Security Inc and can be used with any e-mail application. SecureMail is compatible with desktops, laptops and netbooks.

If you receive a secure message this way, you will need to set up a SecureMail account. To set up the account and view your message, you will need connection to the internet and access to a web browser.

How secure are SecureMail messages?

The secure e-mail is encrypted with the equivalence of a 1024-bit key. It uses breakthrough identity-based encryption to ensure the privacy of confidential information without compromising ease of use. Each message is also signed by the sender to ensure authenticity of the sender and data integrity of the message.

In addition, all decrypted e-mail messages are viewed through your web browser using an SSL/TLS connection.

Is the SecureMail solution suitable for everyone? 

Messages sent via SecureMail can be received securely by any e-mail application. To view the secure message, you must also be connected to the internet and have access to a web browser.

Will using SecureMail to read my message cost me anything?

There are no cost implications to receive or reply to e-mails encrypted by SecureMail.

Will I have to download or purchase any software to receive secure e-mail via SecureMail?

There are no requirements to download or purchase any new software when using SecureMail.

When I previously used SecureMail, I downloaded an application for my BlackBerry. This application no longer works. Why?

Due to changing technology on BlackBerry and customer feedback, it was felt this application should be withdrawn. Depending on your phone browser, you may still be able to access the message from your BlackBerry; however, viewing SecureMail messages on your BlackBerry is not recommended and no longer supported by HSBC.

I do not have TLS configured on my e-mail server and do not have a web browser to view a SecureMail message. How will I be able to view the secure message?

If you cannot accept TLS e-mail traffic and do not have a web browser to use SecureMail, we will not be able to send you the information securely by e-mail using Forced TLS or SecureMail. Contact the originator of the message, who can talk through appropriate solutions to sending the information via an alternative secure method.

Remember, it is against HSBC's policy to send information insecurely if the information could pose a risk to you, HSBC and other customers if intercepted by someone else.

How will I know the e-mail has come from HSBC via SecureMail?

Every e-mail that your recipient receives via SecureMail will contain the same anti-phishing image that is assigned to you on your first SecureMail e-mail from your HSBC relationship manager or HSBC representative. If you are ever in doubt, contact your HSBC relationship manager or HSBC representative by telephone rather than e-mail.

Can my company set up one SecureMail account for all their employees?

For security and technical reasons, each recipient of the e-mail must have a SecureMail account to ensure the e-mail is going to the authorised individual. Therefore, your company cannot set up one SecureMail account for all employees.

If the e-mail is sent to a shared e-mail account, the owner of the account will need to set up a SecureMail account and share the account access details in accordance with your company security policies.

What about the possibility of SecureMail being blocked by spam filters?

Spam filters work in different ways. They may filter e-mails by looking at the e-mail header, subject line or e-mail content, or simply looking at the frequency the e-mail is received from a source that you have not authorised. Depending on the spam filter used by your e-mail service provider, e-mail from HSBC encrypted by the SecureMail may be blocked or placed in your junk mail. If you are expecting an e-mail but do not see it in your inbox, check first your junk box, or if you have received notification that an e-mail has been blocked, check the sender's e-mail address. If you trust the source, then you can continue to retrieve the e-mail in the way that you normally do. You may also need to change the settings on your own filter; for example, some settings prevent encrypted e-mail being received.

Will all e-mails from HSBC be encrypted by SecureMail?

E-mails will only be encrypted if the information contained could pose a risk to you or HSBC if intercepted by unauthorised recipients. If a Forced TLS connection is not in place with you, your e-mail will be encrypted by SecureMail or an alternative approved solution that secures the information delivered to you. 

Where can I find more information about SecureMail?

Visit www.hsbc.com/secureemail for more information about SecureMail.

Who can I contact for more help with SecureMail?

If you cannot find the answers you are looking for here or from any information provided on the www.hsbc.com/secureemail website, contact your HSBC relationship manager or HSBC representative who sent you the e-mail.

E-mail domain

E-mail domain is the part that follows the @ sign in an e-mail address (eg name@youremaildomain.com).

E-mail server

An e-mail server processes inbound e-mails in some way (eg filter spam) before it is delivered to the recipient’s e-mail inbox.

Encryption

Encryption is the process of transforming data so it is unreadable to anyone, except the party that is authorised to receive it.

Forced TLS

Transport Layer Security (TLS) is a user transparent way of encrypting the transmission of electronic mail from one organisation to another over the Internet. TLS is a security protocol that is based on the Secure Sockets Layer (SSL) 3.0 protocol which has been in existence since 1996. Forced TLS is a configuration that has to be set on the sender and recipient's e-mail server in order for the e-mail to be transported securely.

Secure e-mail

Secure e-mail is an e-mail that has been encrypted so that it can be sent securely over the internet.

Server
A server is computer system or device that manages network resources. Often, servers act as storage devices for files.

SSL

Secure Socket Layer (SSL) provides enhanced security for internet communications. It uses encryption (see above) to ensure the confidentiality of sensitive information, such as credit card numbers, account balances and other financial and personal data, that is sent between a web browser and a web server (see above).

Web browser

A web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web.

If you are unable to find the answer you looking for from the information above, refer to your HSBC relationship manager or the HSBC representative who sent you the secure e-mail. They will assist you or progress your query internally.