Check email layout and make it secure — Stripo.email

To ensure your email marketing strategy is successful, it is important to implement the principles of email security and data protection that we discussed in a previous article when developing your email template design.

In this article, you will learn to what email marketers must pay attention to protect subscriber data. Another reason secure design is significant: in addition to ensuring the security of subscriber data, it directly affects email deliverability, as email clients analyze each email, so if it looks suspicious or may compromise subscriber data, they send it to spam and issue a warning.

Which email design elements can pose data security issues?

Concerning elements in email design typically include requests for recipient data or the in-depth study of additional information via a file or link. For an email marketer, such interactions are essential for engagement and obtaining information for segmentation. However, attackers can use similar blocks to obtain sensitive data and spread viruses.

HTML and JavaScript

Concern: Cybercriminals use Flash, JavaScript, and ActiveX to distribute viruses, which then collect data, in addition to prohibited CSS styles and HTML attributes. Therefore, most email clients do not support these technologies and are suspicious of emails including them because they may contain vulnerable elements or may be used to execute malicious scripts.

Some tips for decision-making:

1. Be careful not to include Flash, JavaScript, or ActiveX in your email when you copy code directly from a website.
2. When you use HTML in your emails, follow the structure of the actual HTML document. Do not use potentially dangerous elements, such as JavaScript, Java applets, ActiveX, VBScript, and IFrames, which are connected to external CSS or Meta Refresh websites.
3. If you still want to add dynamics to your email design, replace Flash animation with a GIF.

Here is an example of an email with GIF animation:

(Source: Email from Pandora)

Links 

Concern: Attackers use insecure links, redirects, or link shorteners to hide the actual addresses of malicious websites or .exe file downloads. Therefore, email clients monitor such links, and as such, recipients often do not trust them and perceive them as dangerous. This situation can also occur when click tracking is enabled, because the URL will convert to an encrypted link and thus a mismatch will occur between the URL and the destination.

Some tips for decision: 

1. Always use links to official company domains. A clear URL helps users verify the authenticity of the link.
2. Do not use third-party services (redirectors, link shorteners) to hide actual information about the landing page.
3. Do not include the full URL in the body of your email — instead, insert it as a hyperlink in the text or image.
4. The design should clearly show where the links lead. For example, use text links with clear descriptions instead of “Click here.”

(Source: Email from StoryBrand)

Attachments 

Concern: Cyber ​​criminals send large attachments or unusual file types that include malicious elements or that may be tools for distributing malware. Simultaneously, in the text of the email, they pass these off as important, useful, or interesting. The email design can thus be used to hide suspicious elements or make them appear harmless.

Some tips for decision-making: 

1. Upload the file to a hosting service and give the subscriber a link to the file in an email. Below is an example of how Stripo formats its download link for a PDF file as a button:

   
   

   (Source: Email from Stripo)

2. If you need to attach several small files, ensure their size does not exceed the allowed limit for different email clients, which can range anywhere from 500 KB to 5 Mb, depending on the client to which you are sending the email.

Images 

Concern: Large embedded images or image-only emails are considered dangerous, as cybercriminals can use these to place text on the image requesting the recipient provide sensitive information or take some action necessary for the scam to proceed. Unfortunately, email client filters cannot scan such text and cannot warn about such danger. As a result, these email types proactively end up in spam.

Some tips for decision-making: 

1. If you want to use a single image in your email layout, consider breaking the image into several parts and placing text under each image; balance the use of images and text to avoid appearing as spam.
2. Use recommendations for incorporating embedded images in emails from this article. 

Look at the sample template below, created by a Stripo designer: It appears to be an image-only email, but it actually contains several images and text blocks.

(Source: Stripo template)

Obfuscated text

Concern: Using invisible text or text that matches the background color, such as white text on a white background or text that blends into the email design, is a common tactic used by spammers and scammers.

Attackers can hide malicious links to avoid immediate detection by users and security tools. Users may thus unknowingly interact with these hidden elements, potentially compromising their data.

In addition, obfuscated text may be adopted to display one set of content to users while the email client is processing another, more dangerous set of instructions. This can lead to deceptive practices where users are deceived into providing sensitive information or downloading malicious attachments.

Some tips for decision-making: To ensure the security and integrity of emails, avoid using obfuscated text. Then, emails will not be flagged as suspicious and subscribers will be protected from data breaches.

Tracking pixels and privacy policy 

Concern: An email tracking pixel is a tiny, invisible tool that collects valuable information. It tells you when and where an email was opened and on what device. This allows marketers to learn how people interact with their emails so they can design their campaigns more effectively.

Cybercriminals can also use tracking pixels to achieve their goals. A pixel configured by scammers can send personal information to a third-party server, allowing users to steal personal data. Tracking pixels can also be used in phishing campaigns, allowing hackers to gather information about their targets. For example, if an attacker knows that an email address is valid and the email recipient can open the emails, the attacker could exploit such a vulnerability by loading malicious content into the email.

If a business collects data without users’ knowledge and consent, it also violates their privacy.

Some tips for decision-making:

1. Consider all data privacy laws and regulations that affect the collection of user behavior across countries and industries.
2. Ensure transparency regarding data collection and processing practices and ensure the security of personal data.
3. Include information about your privacy policy and data processing in the footer of the email.
4. The design must include a clear and simple unsubscribe option, which is also a legal requirement under the GDPR and other regulations.

Ethical data usage is a priority, and balancing the hyper-personalized experiences customers crave and user privacy can be challenging.

Kristen Haines,

The CEO of MailCon, the Chief Events Officer of Phonexa.

Embedded forms

Concern: The problem with using embedded forms in emails to obtain information is that attackers can easily forge such forms, making it difficult for recipients to distinguish legitimate and fraudulent forms. Clicking on these fake forms can also spark phishing attacks, malware infections, and data theft.

Further, subscribers submitting sensitive information using such forms may be more vulnerable to interception or unauthorized access.

Some tips for decision-making (if you still prefer to use a built-in email form):

1. Request only the data you need. The design of the subscription and data entry form should minimize the amount of personal data requested.
   
    

   It’s essential to avoid storing or asking for unnecessary information. Collecting only the data you need for segmentation helps protect user privacy.

   

   Keith Kuzmanoff,

   Leading email marketing strategist.

2. Use encryption (HTTPS) to transmit data to prevent it from being intercepted.
3. Use the secure, interactive module “Questionnaire” in the Stripo interactive module generator to create a form without coding with ease.

Interactive elements 

Concern: Interactive elements in email, especially Accelerated Mobile Pages (AMP), are used to create email mechanics, such as carousels, accordions, and different forms of gamification, but they present security risks. Dynamic content can be manipulated for phishing attacks, allowing users to interact with malicious forms or links without leaving the email client.

By verifying AMP emails, Google aims to protect users from such threats as phishing, malware, and data breaches by checking and blocking every email message they deem suspicious.

What email clients, ESPs, and email builders do:

1. Only whitelisted companies are allowed to send AMP-based emails. Both Gmail and Yahoo carefully vet each brand before adding them to their whitelists.
2. Whenever Gmail and Verizon decide whether to show the AMP version of an email to recipients, they check the CORS headers. If the CORS requirements are not met, a fallback email option is displayed. However, AMP content cannot be redirected.
3. For email security, the AMP email block has an expiration date. The email client stops displaying it after 30 days if the user replies or forwards an AMP email or when the cache is updated.
4. ESP and email builders, in turn, review the code of AMP emails using a speed limit. If many requests are sent from one IP address, the system manually checks the contents of such emails.

Some tips for decision-making:

1. Follow strict rules for CORS header settings.
2. Use an interactive fallback, then subscribers will always see the interactive version of the email.
3. Remove unused AMP scripts, and ensure all resources are loaded only through HTTPS.
4. Use ready-made interactive modules to avoid errors and dangers.

Below is one example of gamification, the “Find a Pair” game, which you can create using the interactive module generator:

Additional methods for greater email design security

In this section, you’ll find tips and tactics to help you stay ahead of the threat — create email designs that are difficult to imitate and that maintain subscriber awareness to ensure their data are kept safe.

Anti-phishing email design

Email design can be an excellent weapon in the fight against phishing attacks and can protect your brand from reputation harm and your subscribers from losing sensitive data. 

Here are a few elements you can incorporate:

• official logos, corporate colors, and fonts that users associate with your brand in your email layout;
• unique graphic or design elements that are difficult to counterfeit;
• email personalization — use the recipient’s name and other personalized information available only to you and the user;
• email signature and contact information;
• the same format, structure, and tone in each email so users can more easily recognize fake emails that do not match the usual communication style;
• mobile optimization and dark mode — if your emails look equally good on both desktop and mobile devices in light and dark modes, this indicates a serious attitude. Fraudsters rarely waste time on such subtleties.

Educational materials

Being forewarned is being forearmed — remind subscribers to recognize phishing and other data security threats and protect their data. This approach is especially relevant for companies that provide sensitive user data, such as banks, insurance services, etc. They must educate their subscribers and remind them that they do not ask for passwords or to gain access.

An excellent way to show support is by including in your newsletters information about how users can report suspicious emails. This could be through a dedicated email address or a form on your website.

Wrapping up

Ensuring the security of email design is crucial to protecting subscribers from potential threats. External scripts, embedded forms, large attachments, insecure links, excessive images, and obfuscated text can significantly increase the risk of data breaches and phishing attacks. By eliminating these risky elements, email marketers can reduce the chances of their emails being flagged as dangerous and enhance the overall security of their communications.

A secure email design protects user data and builds trust between the brand and its subscribers. As such, implementing best practices in email security helps maintain a positive reputation and ensures that marketing efforts reach the intended audience without being compromised. Ultimately, prioritizing email security is essential to creating a safe and trustworthy email environment, benefiting the organization and its subscribers.