cc or bcc?
- That is the question!

Version 1 - 1st December 2013



"Sending an email to a distribution list where recipients are in the cc field...

... is a highly effective way of divulging your mailing list to your competitors"
   



 

Summary / Recommended Practice

When sending an eMail to a group of people - especially when it's a mailing to clients - always consider using the BCC and **not** the cc field.

cc and bcc - Explained

  • cc means Carbon Copy.
  • bcc means Blind Carbon Copy.
  • Recipients on a cc list can see the email address of every other recipient.
  • Recipients on a bcc list cannot see the email address of every other recipient.

Practical Consequences

  • If you send an email to a cc list, if a recipient accidentally <REPLIES TO ALL>  rather than <REPLY ONLY TO SENDER>, the ramifications could be unintended and embarassing. The setting <REPLIES TO ALL> is the default behaviour in some eMail clients.
  • If you send an email to your clients - eg an en masse circular - an use the cc field, because everyone can see everyone else's email address, your entire Client Mailing list is now in the public domain.
    - as a rule of thumb, use the bcc when the recipients do not know each other or have no need to know each other.
  • If you want people to KNOW who else has seen a copy, use the cc field
    - this is usually acceptable and practical for small groups of recipients who know each other.

The Spam Connection

  • And then there's the spam (and worse) connection.....
  • It could be argued you have a duty to protect your clients from spam and other cyber attacks.
  • My email systems sit behind a barrage of firewalls, spam filters and numerous other security measures. All of my systems are regularly updated with Security Patches. I work in IT - you'd expect nothing less.
  • Other's aren't so careful (anal?!)
  • If you send an eMail to your clients as a large distribution list and use the cc field, all of your clients' email addresses could, potentially reside on the computers of perfect strangers to them.
  • So what?
  • Well, if other people's systems are not adequately protected, when they are hit by a spammer, scammer, malware attack etc - one of the first things that happens (to assist propagation) is all email addresses on the compromised system are harvested and then targetted (by the rogue code running on the compromised computer) ....  Thanks to the cc, you could have exposed your clients numerous other attack vectors.