Capital One forcing me to “prove” I opened their emails | Hacker News Reader

Capital One forcing me to “prove” I opened their emails

15 pointsCapOneCustomer18 comments

I have a Capital One credit card. I have my account configured so that I receive email notices for various activities (bill due, card charged, unusual transactions, etc.). Recently, I received an email (legit) from Capital One that reads in part:

------------------------------------

Open emails regularly to continue receiving notifications.

Recently, we updated the Paperless Terms & Conditions for your account. We've modified the Terms to make it clear that you'll need to open a Capital One email once every 12 months to continue receiving email notifications like statement ready alerts.

------------------------------------

From a tech perspective, I'm perfectly aware of what Capital One means by "open" - "load a tracking beacon". Since I don't (and won't) I assume I won't be receiving any email notices 13 months from now.

Personally, I find this requirement from Capital One to be appalling. I'm curious if anyone else has received a notice like this (do other banks do this?) and what your opinion is.

This is why you don't give the business unreliable metrics.

Whoever came up with this requirement at capital one had the sense that email surveillance was capable of delivering meaningful read metrics. Who let that happen?

You may understand the implementation makes the metric comically unreliable, especially for email with so many clients that block images by default. But when is the last time you quantified the margin of error in all the metrics reporting? Never? Great rigor you've got going there, data science. Even if you do clarify how poor the signal is, how long until someone copy-pastes it into Excel, removes that context and shows the graph to someone with more decision making power? And that's the best case scenario. People are, in general, way more statistically illiterate than you suspect. Remember how many people saw Hillary had 85% on fivethirtyeight, and were convinced that it meant she would win?

I've had arguments with Amazon employees that: no, they do not know how many people open their emails. Trying to explain what they have is a lower bound that is closer to "how many emails are read in gmail on an iphone" than "how many emails are read"? Nope. The UI says "unread," therefore it is impossible that the user read the email.

Stop implementing bullshit metrics in your software.

There is a trend in inboxing-rates: if there is no interaction with a sender, start moving the messages to spam and start penalizing the sending IP address. This means senders, in order to protect their IP reputation, do well to remove recipients who don't engage with email sends. The two most typical ways to do that are a tracking pixel or tracking if a link is clicked.

It seems like a natural progression. What is unfortunate is that the inboxes are really part of the problem because measuring engagement and lowering spam is a good thing, but just because I did not open the mail (load tracking pixel) or click a link, does not mean I did not engage. Reading a subject line is good enough for a lot of email I get. Many users have images blocked, and tracking pixels are rendered useless. I still have email that Gmail puts in spam that I really want, but I only use the subject. It is a non-trivial problem because there is an arms race between inboxes wanting to prevent spam and spammers wanting in, and in the middle is businesses who have legitimate email to send or normal people sending email.

Call them up every month and tell them that you've read their email.

After 13 months, if/when the emails stop, call them up again and ask why they've stopped.

For even more fun, figure out which domain(s) they use for tracking and have your router/firewall block them.

Then when you complain about not receiving the emails, you can still say that you've been doing "load images" to no effect.

I can imagine plenty of practical reasons for such a policy, like customers who have paperless statements going to an email address that they no longer check or have access to.

If you don't like this just switch to paper statements. Wanting to receive financial statements without leaving any evidence that you received them doesn't fall under any definition of privacy that I know of.

Dude, privacy is the definition of not leaving evidence.

It seems reasonable to me to not want to waste resources sending emails that will not be seen. Opening an email once a year does not seem very onerous.

Also, they probably have a way to turn emails back on via the website / app so just mark it on your calendar.

The question isn't one of "that will not be seen" it's one of "they don't know if it's seen because the reader didn't use the mechanisms which allow email tracking."

I believe tracking pixels are the only way to track email opens. I think their goal makes sense and it's unfortunate that it doesn't work for privacy focused customers.

Another is X-Image-URL, though most mail readers don't support it.

It also doesn't work for the generation of people who started with text email so acquired a belief that if it can't be expressed in text (or maybe with an attachment) then it isn't worthwhile.

At least, that's my belief.

Tracking - or the lack thereof - is their problem, not mine. I don't feel I should be obligated to participate in order to be notified that my account has been compromised.

And I certainly don't care about their "goal", whatever that is.

> Opening an email once a year does not seem very onerous.

What if they change "once a year" to "every month"? Then "all the time"? Slippery slope and all that.

I wonder if the issue might be some question about if the user is receiving statements or not.

IIRC even statements sent to customers are covered by some banking regulations and if they're not done right there can be serious fines.

Ages ago I worked on equipment that ran printers that printed financial statements. Any hint that anything might be late got the executive team nervous and their full attention. It was serious stuff.

Granted that was years ago and they could just want to track you but if the requirement is just every 12 months... that really doesn't seem like effective tracking.

Perhaps another issue is a security check, such as a dormant or hijacked email that would otherwise expose itself by reading all their emails from another country unexpectedly?

> I wonder if the issue might be some question about if the user is receiving statements or not.

Couldn't they just ask me? Then I could reply (or not).

> Perhaps another issue is a security check, such as a dormant or hijacked email that would otherwise expose itself by reading all their emails from another country unexpectedly?

A tracking beacon is no guarantee that I opened the email, just that somebody (with access to my account) opened the email, no?

Certainly none of it is a sure thing but doing due diligence might still be worthwhile of there are any regulatory or security questions.

It just doesn't strike me that every 12 months would provide much tracking value.

It's a federally endorsed banking account, you can't enjoy such services without assuming tracking liabilities.

If this is a burden to you, why not just open the emails in a text-only client?

The OP wrote "I don't (and won't)" use an email reader with such tracking liabilities.

> you can't enjoy such services without assuming tracking liabilities

None of my other bank/credit accounts have threatened me this way.

I also received this email and was concerned about it. It seems to be a new trend.

Reply on news.ycombinator.com