The Postcard You Can't Take Back

The numbers

What to land

• Email is now universal. 89.45% of Americans over 15 use it. In Nigeria, it's 98.1% of internet users.
• It's also your identity — it logs you into your bank, your medical portal, your tax records, your Netflix.
• And it's fundamentally insecure by design. The protocol that runs it — SMTP — was written in 1982 with what one cybersecurity expert called a "trust everyone" model.
• The average person checks email 15 times a day. 58% check it before social media or the news.
• Employees spend 11 hours a week on email — roughly 2,970 working days across a 45-year career.

The stats

What changed

• By October 2025, AI-generated phishing became the top enterprise email threat — surpassing ransomware, insider risk, and traditional social engineering combined.
• Generative AI lets attackers write a perfect, contextually-aware phishing email 40% faster than the old way. They can also send 10,000 of them, each personalized.
• 87% of organizations report being targeted by an AI cyberattack in the past 12 months. 91% of security leaders expect daily AI attacks by 2028.
• A 2025 survey found 70% of consumers say it's become harder to identify scams in the past year. Confidence is dropping. Reality is getting worse.
• Total financial losses from phishing hit $17.4 billion globally in 2024 — a 45% year-over-year jump.

The personalization problem

What makes 2025 different from 1995 isn't just that the grammar is good. It's that the AI is scraping LinkedIn, corporate filings, social media, and breached databases to write phishing tailored to each individual recipient. The email looks like it came from your CFO because it references the spreadsheet they actually share with you. It looks like it came from HR because it references your benefits enrollment that just happened.

The FBI now warns publicly that criminals are "leveraging AI to orchestrate highly targeted phishing campaigns" with perfect grammar and contextual awareness. Special Agent Robert Tripp: "These tactics can lead to devastating financial losses, reputational damage, and compromise of sensitive data."

BEC: the quiet catastrophe

How a modern BEC scam works

• The attacker compromises one mailbox — usually through a phishing click — at a small vendor.
• They sit silently for weeks, reading email. They learn invoice numbers, vendor relationships, the way the CFO writes. They wait for the right moment.
• Then they send an invoice. A real one. With real PO numbers. From the real vendor. With one tiny change: the bank routing number.
• By the time anyone notices, the money is gone. Average BEC fraud detection time: 47 days.

Now add deepfakes

• Deepfake fraud attempts have risen over 2,000% since 2022.
• Deepfake files surged from 500,000 in 2023 to 8 million in 2025.
• Voice cloning is now the most common attack vector. Three in four AI voice scam victims lose money.
• Human detection rate for high-quality deepfake video: 24.5%. We are statistically worse than guessing.
• 53% of financial professionals had experienced an attempted deepfake scam by 2024.
• By Q1 2025 alone, there were more deepfake incidents in three months than in all of 2024 combined.

The Arup aftermath

Arup spoke publicly about the deepfake heist. Most companies don't. Estimates suggest fewer than 30% of BEC incidents are ever reported — companies fear reputational damage, lawsuits from shareholders, and loss of customer trust. The actual number of BEC scams in 2024 was almost certainly several multiples of $2.77 billion.

The biggest breaches in history — all email

• Yahoo (2013-2014): All 3 billion accounts compromised. The largest data breach in history. Disclosed in 2016.
• 2025 infostealer leak: 183 million email passwords exposed via malware that scraped browsers.
• 2025 mega-breach: Researchers documented exposure of 16 billion login credentials — described as the largest cyberattack in history.
• December 2025 Wired/Condé Nast: 2.3 million email addresses leaked along with names, addresses, and phone numbers.
• Roughly 60% of all data breaches are linked to a human action — typically a phished email or a stolen email password.

Why email became the master key

• The average user has 1.86 email accounts — meaning roughly 8.3 billion email accounts on Earth. But each of those accounts unlocks dozens of other services.
• Password reuse is endemic. The most common Hotmail password ever discovered: "123456" — used by more than 10,000 accounts at the time of analysis.
• Most websites use email-based password reset. Compromise the inbox, compromise everything connected to it.
• Phishing-resistant multi-factor authentication exists. Most people don't use it. Most companies still don't require it.

The Yahoo story worth telling

The Yahoo breach is worth a few minutes on its own. The 2013 attack was undetected for three years. When Yahoo finally disclosed in 2016, they said 1 billion accounts. A year later, they revised it to all 3 billion. They had hidden the breach from Verizon during acquisition negotiations — when it came out, the deal was repriced significantly. The CEO declined to force a global password reset, reportedly fearing customers would leave for Gmail. Hundreds of thousands of US government and military email accounts were among the exposed.

The Snowden revelations — what we actually learned

• PRISM: Direct NSA access to data from Microsoft (2007), Yahoo (2008), Google (2009), Facebook (2009), PalTalk (2009), YouTube (2010), AOL (2011), Skype (2011), Apple (2012). Internal NSA slides said 91% of NSA internet traffic acquired under FISA Section 702 authority came from PRISM.
• XKeyscore: Described internally as "the NSA's Google." Let analysts search emails, browsing history, and chats by entering a person's email address. No warrant required.
• Tempora: The British equivalent. GCHQ tapping fiber-optic cables to collect emails, social media activity, and call data. Snowden said GCHQ was "worse than the U.S."
• Bulk phone metadata: Under Section 215 of the Patriot Act, the NSA collected records of virtually every phone call made in the United States — who called whom, when, for how long.
• Optic Nerve: GCHQ collected webcam imagery from 1.8 million Yahoo users in a single six-month period in 2008 — including sexually explicit content. None were suspected of wrongdoing.

The lie that started it

On March 12, 2013, Senator Ron Wyden asked Director of National Intelligence James Clapper a direct question under oath: "Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?"

Clapper's answer: "No, sir. Not wittingly."

It was false. Clapper knew it was false. He later called it the "least untruthful" answer he could give. A federal appeals court would eventually rule the bulk collection program he was lying about was illegal. He was never prosecuted.

The Lavabit showdown

Ladar Levison ran a small encrypted email service called Lavabit. About 410,000 customers. Edward Snowden was one of them. In July 2013, the U.S. government served Levison with a search warrant demanding he hand over Lavabit's master TLS encryption keys — which would let the FBI decrypt not just Snowden's email, but every customer's. He was placed under a gag order. Faced fines of $5,000 per day for contempt.

On August 8, 2013, Levison shut down Lavabit entirely rather than hand over the keys. He destroyed his own ten-year-old company to protect his users. Then he was forbidden from explaining why.

The pattern Snowden exposed

• Secret legal interpretations the public could not challenge because they could not know they existed.
• A FISA court that approved 99.97% of government surveillance requests.
• Classification systems that made exposing abuse a federal crime.
• An intelligence community that "learned from each exposure not to stop, but to hide better." (Bruce Schneier)
• Most of what Snowden exposed remains in place today. The bulk phone collection was eventually ruled illegal. Most of the rest was simply legalized.

The European rebellion

Austrian privacy activist Max Schrems used the Snowden revelations to challenge EU-U.S. data transfers:

• Schrems I (2015): The Court of Justice of the European Union invalidated Safe Harbor — the legal framework for moving data between Europe and the U.S.
• Schrems II (2020): The replacement, Privacy Shield, was also struck down.
• Meta fine (2023): €1.2 billion — the largest GDPR fine ever — explicitly cited the Snowden revelations as foundational.

Edward Snowden remains in Russia. He cannot return to the United States. He was granted Russian citizenship in 2022. Tech companies, embarrassed by their PRISM cooperation, did encrypt server-to-server email traffic almost overnight. Bruce Schneier later called this Snowden's biggest legacy: "We actually encrypted the web."

What tracking pixels reveal

• Your IP address — gives approximate location, often down to the neighborhood.
• The exact timestamp you opened the email — down to the millisecond.
• Your device, OS, browser, screen resolution. Some can detect dark mode.
• How many times you opened it. From how many different IPs (revealing if it was forwarded).
• Up to 24.7% of all emails — not just marketing, but transactional and personal — contain at least one tracking beacon.

The $247 billion industry you didn't know about

What metadata actually reveals

The pitch from advertisers and intelligence agencies is the same: "We don't read content. We just collect metadata." This is supposed to be reassuring. It is not. Researchers have shown that metadata alone — who you email, when, how often, from where — can reconstruct:

• Your work schedule, sleep schedule, and circadian rhythm.
• Your professional, romantic, and family relationships with high accuracy.
• Your vacation periods, sick days, and travel patterns.
• Your health concerns based on which support groups, clinics, and pharmacies you correspond with.
• Your political beliefs, religious practice, sexual orientation — all inferred from communication patterns.

Email address as the new cookie

As web browsers cracked down on third-party cookies, ad-tech pivoted. Your email address became the universal tracking identifier — persistent across time, portable across devices, and (because you handed it over yourself) seemingly consented to. When you signed up for a newsletter, you didn't just get a newsletter. You signed up to be cross-referenced against every database the sender's analytics partners could access.

Apple Mail Privacy Protection (introduced 2021) and Gmail's image proxying have weakened tracking pixels significantly — Apple Mail alone holds 50–60% of email client market share globally and now pre-fetches all images, breaking the timing data. Privacy improved by accident, because two large companies decided it should. That should not be the only line of defense.

The journey of an email

• Step 1. You write your email. You hit send. Your client connects to your provider's outgoing server using a 1982 protocol called SMTP — Simple Mail Transfer Protocol.
• Step 2. SMTP, by default, is plain text. Like a postcard. Every word, every recipient, every subject line — readable to anyone watching the network.
• Step 3. Your email travels through one or more relay servers. Each one holds a complete copy. At least temporarily.
• Step 4. Each server stamps the email with a "Received:" line. Open any email and look at "View original." Every Received line is a server that held your email as readable text — and could have copied it.
• Step 5. It arrives at the recipient's provider, sits in their inbox, and is read.

The patches bolted on

STARTTLS (introduced 2002) encrypts the connection between two servers — like wrapping the postcard in an envelope for the journey between mail trucks. It has critical limitations:

• It is opportunistic. It says "please encrypt if you can." If a server doesn't support encryption, the email goes through anyway. Plain text.
• It can be stripped. An attacker can cancel the encryption request entirely — a STRIPTLS attack. Both sides default to plain text and never know.
• The email is decrypted at every server along the way. The envelope only protects the journey between trucks. At every sorting facility, the postcard is naked again.
• Even when STARTTLS works perfectly: the metadata is not protected at all. Sender, recipient, subject line, timestamps — all visible.

What real encryption looks like

End-to-end encryption is a fundamentally different design. The message is encrypted on your device, before it leaves. Only the recipient's device can decrypt it. The mail servers in between cannot. The provider cannot. The government with a subpoena cannot. Even the company that built the email system cannot read your mail.

It's the difference between mailing a postcard, mailing it inside an envelope that gets opened at every sorting office, and mailing a locked safe that only the recipient holds the key to.