One of ITWeb’s most-read stories recently was about fake AARTO traffic fines. The scam messages quoted motorists’ correct number plates and arrived by SMS, WhatsApp and e-mail. Fraud like this works because people have learnt to act on what lands in their inbox. Banks and insurers taught them to.
That leaves banks and insurers with two problems. One is the fake e-mail, written by criminals in the bank’s name. The other is closer to home: the genuine e-mail that went out with an old clause, a wrong figure or a version nobody signed off. Both are e-mails nobody at the bank approved, and both wear away the trust customers place in their inbox. Banks cannot stop criminals from sending fakes. They can make their own e-mails hard to fake and always correct, and the second job gets far less attention than the first.
The e-mail has quietly become the letter
In South African financial services, e-mail has replaced the letter for almost all customer correspondence, and the decline of the South African Post Office has only sped that up. Policy confirmations, premium increase notices, payment reminders and claim outcomes now reach customers by e-mail first, and often only by email.
An e-mail that confirms cover or explains why a claim was declined does the same job as the paper letter it replaced. The rules that applied to the letter do not fall away because it now arrives by e-mail. Customers still need clear and accurate information, and almost every one of these e-mails contains personal information, so POPIA applies to every send.
Make the real e-mails hard to fake
Part of the defence sits with the bank’s IT team. Mail providers can check whether an e-mail really comes from the bank’s own domain, but only if the bank has set up e-mail authentication and told them to reject anything that fails. That stops fakes that use the bank’s exact address. It does not stop lookalike addresses with one letter changed, so banks also need to spot those domains, have them taken down, and write from one address their customers know.
The other part is consistency. Customers recognise a genuine message by its patterns: the sender, the layout, how it addresses them and what it never asks for. When an institution’s own e-mails look different from product to product, those patterns blur, and a well-made fake has less to stand out against. Consistent templates also give the security team one place to enforce a rule such as “this message never contains a payment link” across every product line.
The e-mails nobody checked
In DocFusion's work with banks and insurers, the same pattern keeps coming up. Letters and statements come from a governed set of templates, with version control, compliance sign-off and a named owner. The e-mails came later, built by a digital or marketing team in a different tool. Some are hand-coded HTML. Some have figures or clauses typed straight into the template. Many exist in several copies, one per product or brand.
The risk shows up when something changes. Compliance updates the wording of a disclosure, and the letter template changes the same day. The e-mail versions carrying the same disclosure wait for someone to remember them.
One question exposes the gap. For an e-mail your organisation sent a customer on a given date, can you show which template version produced it, what data went into it and who approved that version? Ask it about a letter and most compliance teams have an answer. Ask it about an e-mail and the answer is often a search through a marketing platform’s send history.
Where AI fits, and where it does not
Generative AI makes e-mail look easy. It can draft a premium increase notice in seconds and adjust the tone for each reader. That is useful. Used carelessly, it also multiplies the second problem: more versions, written faster, and checked by nobody.
The line I would draw is that AI can re-express the truth, but it cannot re-decide it. The facts in a customer e-mail – such as the amount, the due date, the policy number and the reason for a decision – must come from the system of record every time. AI can help a template author write clearer wording while the template is being designed, and a person accepts or rejects each change before it goes live. When the e-mail is sent, nothing is invented.
Treat e-mail as a document
Customer e-mail is now a generated document like any other. In practice, treating it that way means three things.
- Know what you send. List every transactional e-mail template, who owns it and which system triggers it.
- Keep one source for words and facts. Disclosures, privacy notices and complaints wording should live in one place and flow into letters and e-mails alike, and no figure, date or rate should be typed into an e-mail template.
- Govern and test e-mail like letters. Each template needs version control and approval, and a check of how it renders in the main e-mail clients before it goes live.
None of this means giving up on well-designed e-mail. It means building e-mail in the same governed document generation environment as letters and statements.
A test worth running this quarter
Pick one regulated e-mail, such as a premium increase notice, and try to answer the question from earlier for it. If that takes more than a few minutes, you have found the gap, and the next e-mail nobody approved may be one you sent yourself.
About the author: Rein van der Horst is CEO of DocFusion, a South African document generation platform that banks and insurers use to produce letters, statements and other customer documents from approved templates.
Contact: Rein van der Horst, Rein@docfusioncloud.com
Share
