@samhenrigold I think it’s because on the inbox you actually use you could receive phishing mails, but not in their apps.

@samhenrigold i would be a lot more ok with them doing this if logging into the banks web app didnt involve 30 layers of security questions and a summoning ritual just to find out theyre making an immaterial change to my interest rate

@samhenrigold I can't tell if this is to be provactive, or because you really don't know.

In case of the 2nd, doing it in this annoying way provides multiple important security features: privacy, auth, and delivery confirmation.

The bank knows the message is private, because it never left their own system, they know it was delivered to you, because they trust the authentication used to access their web ui, and they know if and when you accessed (and presumably read) the message.

🧵 1/2...

Our banks have a chat in their app. You just get a push notification for new messages.

@samhenrigold when I was buying my house, my bank had a whole separate website just specifically for sending messages related to mortgages. It had an entirely different login on its own domain. it was just an inbox.

@samhenrigold just remembered i had a fun one of these recently: i closed out a bank account, and then the bank sends me an email saying there’s a message in my inbox…

i go to log in to the bank to see the message (presumably confirming the closed account), but because i no longer have an open bank account, they wont let me log in.

i have no way to read their message!

@samhenrigold Wells Fargo? Ewww.