I’ve read a number of articles that say we should use Reply-to-All very sparingly, so as to reduce the volume of unnecessary email people are getting. There are also those who try to discourage us from using the BCC feature, on moral grounds.
Although I agree with these noble reasons, I’d like to add another, much more practical reason why we need to be extra careful before using these features.
If you are a BCC recipient of a message, when you Reply-to-All, people will wonder how you got involved, and will realize that the original sender blind-copied you. This can be rather embarrassing for the original sender, who deliberately tried to hide the fact that you were copied. Who knows what can of political worms you are opening by doing this!
What about the other side of the coin? How can we blind-copy someone without risking exposure? Here’s a much safer way:
Address the message in the normal way to the regular recipients, then enter your own address on the BCC line and send the message. When you receive your copy, forward it to your secret correspondent. Because your forwardee is the only recipient, s/he cannot inadvertently expose your “conspiracy” by misusing the Reply-to-All command.
For those of you who are wondering: yes, I did learn this the hard way. I’ve never used the BCC feature since!
For those who prefer the moral approach: BCC = Blind Co-conspirator
Email programs have not changed much in the past decade, but the amount of email we get has grown by a tremendous amount, significantly impacting our email productivity. The average information worker gets far more mail than s/he can cope with, and an increasing number of people suffer from "email overload". In this blog, Itzy Sabo analyzes the causes of email overload, discusses strategies to cope with the constant bombardment, and provides practical tips for getting the most out of our email programs. 
39 responses so far ↓
chris // June 1, 2006 at 5:42 pm |
Well, yes. Or you could just leave the BCC field completely empty, send the mail, then go into your “Sent” mailbox and forward your own mail.
I just don’t see the point of BCCing yourself first and forwarding the mail you receive, as opposed to the mail you sent. (But maybe I’m missing something here.)
Itzy Sabo // June 1, 2006 at 6:22 pm |
You are right — if you can be bothered to fish the mail you sent out of Sent Items, fine.
Isn’t it easier to have it come to you, rather than going to look for it?
Ryan Walters // June 1, 2006 at 6:37 pm |
Alternately you can just drop every name in the BCC box with none in the TO or CC boxes. This has the disadvantage of usually* revealing to the recipients that they were BCC’d, tipping them off to the possible presence of other BCCers. But it’s quick.
* Some mail systems/programs do weird things.
R S // June 1, 2006 at 7:38 pm |
Seriously, Itzy? Your Sent folder is that faaaar away?
Plan1:
1. BCC yourself.
2. Wait for mail to come. La la la.
3. Forward mail. Have duplicates of the same message lying around.
Plan2:
1. Click Sent folder. The one you just sent should be the first listed. No fishing required.
2. Forward mail. Done.
M. Sapp // June 1, 2006 at 11:58 pm |
I tried this just now with Thunderbird and could not get ‘a received’ or ‘a sent’ bcc to forward. The undisclosed recipients does not come with the email.
Am I doing something wrong? or Right?
wd // June 2, 2006 at 2:56 am |
I just BCC everyone and send to a fake and verifiably non-existant address OR better yet my own e-mail in the TO field.
Disadvantages of this method:
- you usually get an error back from the remote server that the recipient does not exist (in Outlook Express you were even allowed to use allmybuddies@ with nothing after the @.. but this has weird results if some domain actually has an “allmybuddies” e-mail address at their domain, but when using something like thismailhasbeensenttoallthatareconcerned@yourdomain.tld it will be less likely to become an issue if you get my meaning)
- depending on the mail client used, it is harder to trace back whom you sent the e-mail to after the fact if you don’t remember
Advantages of this method:
- anyone who replies “to all” will reply to either the fake address (which returns an error) or to you
- avoids accidental exposure to other recipients
- avoids unnecessarily easy exposure of addresses to worms and viruses in other peoples computers and zombie-PC’s, which slows the spreading of such malware and avoids you becoming a passive participant in infecting someone elses’ computer
- on most mail clients, the mail looks a lot cleaner than the use of a gazillion addresses and names for spammers to harvest and hard to read for the recipients (scrolling all the way down to get to the message)
To sum up, I actually reverse the policy. In MOST circumstances, I send TO: myself@mydomain.tld and BCC: list-of-recipient-addresses. Any replies, including reply-to-all will be sent to me alone.
The EXCEPTIONS to this: when I specifically want two ore more specific recipients to mutually know that they got this message, such as when dealing with person A but then dealing with person B whilst officially keeping person A informed out of courtesy or agreement — however I try to limit this to two or three recipients at the most.
Sonnie // June 2, 2006 at 8:56 am |
I was once embarrassed by this. I sent an email to a colleague about his mishandling of a certain process, and bcc’ed the other involve coleagues. In the process, the bcc’ed colleagues joined the discussion by using the reply to all option…
Learned my lesson the hard way, never thought that the bcc reply will be sent to all as well. Stupid me =(
Mau // June 2, 2006 at 1:45 pm |
I perhaps the lesson that needs to be taught is to look at the header before you reply to see if you were BCC’d.
There’s nothing wrong with the BCCers. They are using the tool for what it’s designed for. It’s the hasty replies without looking that are the problem.
For that matter, it’s a safe policy to always look at who the message was sent to before using “Reply to All”.
Just my .02.
Andy // June 2, 2006 at 11:29 pm |
Mau said it right.
Leadership » Blog Archive » Email tip: Beware using BCC // June 9, 2006 at 7:28 am |
[...] BCC is tempting to use but it is fraught with danger. The problem If someone hits ‘reply to all’ then you get caught out with the deception. Itzy Sabo suggests forwarding the message to others so when they hit ‘reply all’ it comes back to you only. [...]
Brad Isaac // June 10, 2006 at 8:33 pm |
I like the suggestions of ways around BCC. I too am quite paranoid when using it. Before I hit send on any message with BCC recipients, I think to myself “What if the BBC person does reply to all? Is there anything in there I’ve said about someone or something that could come back to haunt me?”
If so, then I try to tone down what I’ve said.
Rob Venstra // June 22, 2006 at 4:20 pm |
Create a custom form which disables the Reply to All possibility (for Outlook users).
Use this form when applicable.
Go to source: Microsoft Office Assistance: Prevent e-mail message recipients from using Reply All or Forward at: http://office.microsoft.com/en-au/assistance/HA011142241033.aspx
Tanuj // July 11, 2006 at 8:24 am |
Is there any way to know the BCC recipients in a received mail??????
Itzy Sabo // July 11, 2006 at 9:16 pm |
Realistically speaking, only if someone foolishly replies-to-all.
Otherwise, only if the sender’s email client and/or server software is buggy — this has happened in the past in very specific environments.
KB // July 21, 2006 at 11:15 am |
I have another problem.
Suppose “A” sends email to “B” and BCC to me.
I get the email with “A” in “From:” field and “B” in TO: field. My email address missing as I am the BCC recipient.
How do I set automatic rule to reply to B.
The automatic reply rule will always send the email back to “A”.
Any ideas???
Itzy Sabo // July 21, 2006 at 12:24 pm |
KB, Why would you want to reply to “B”?
B does not know that “A” blind-copied you and by replying to “B”, you’ll expose what “A” did.
What are you hoping to achieve by such an automatic rule?
KB // July 23, 2006 at 6:29 am |
Thanks for your reply.
Yes, it is hard to comprehend without example.
I am supplier of a product, A is a 3rd party/independent ORDER TAKER and B is the customer.
A, B and myself are NOT related or part of the same compeny/group.
A takes the order from B(over the phone) and generates an automatic email order confirmation which is sent to B and I get a blind copy BCC.
At the moment, I have to manually send an email to B, to let the buyer(B) know about the receipt of their order and send a thank you message.
If I REPLY to this BCC sent to me it goes to A.
If I REPLY TO ALL. Then A and B both will get my email. (I am not sure if I can choose REPLY to ALL in OUTLOOK auto rules anyway.)
The problem is that I do not want A to get this email reply from me, as it contains pricing/other info. they don’t need to see.
So My problem is reverse of what has been discussed before on this page. I WANT the reply to go to B and not to the original sender(A).
I just want the BCC I get processed at my end, which is easy for me to do. Then I want my auto system to send an email to B and NOT to A.
If I get lots of orders the manual processing is a pain.
Sorry, you might have to read it twice to understand it.
regards//
Amanda Greenslade // November 14, 2006 at 6:10 am |
Ah I get it. I was wondering how it is possibly for your ‘To’ recipients to see the ‘BCC’ person when they reply-to-all, but what you mean is if the ‘BCC’ recipient replies to all. Lol that would be dum, and potentially disastrous. And come to think of it, that has happened to me. Thanks for the tips.
Carleton // November 26, 2006 at 12:16 am |
I’d like to offer that BCC is not just a conspiracy technique. Often I will BCC a recipient because I want them to know about the email, however I don’t want to drag them into the discussions that may or may not follow. Of course, they can choose to get themselves into the following email trails with a REPLY TO ALL.
I do agree that if I don’t want someone to know I am sending their email to another person, BCCing has some problems. I’d suggest a phone call . . .
Fulton // November 29, 2006 at 7:09 pm |
Are you absolutely sure that a email can NOT be checked for a bcc? I don’t need to know who was copied just IF it was copied. I used to be able to use the Organize feature and color code all emails sent Just To Me; but that no longer seems to work with bcc. Any other ideas on how to identify an email with a blind copy would be greatly appreciated.
Itzy Sabo // December 6, 2006 at 11:01 pm |
Burt, I’m absolutely sure that any email software that allows a recipient to determine whether a message has been BCC’ed to others will be considered to have a gaping security or privacy hole. This has happened in the past to Outlook/Exchange and Lotus Notes, but only in very specific configurations.
theresag // April 10, 2007 at 6:19 am |
i was a bcc recepient. when I responded to the email, i used reply to all. Will all the bcc recepient recd my response?
Itzy Sabo // April 11, 2007 at 7:40 pm |
theresag: No, only the visible TO and CC recipients will get your reply. However, if they are observant, they will realize that you were a BCC recipient of the original message.
vanessa // April 19, 2007 at 11:10 pm |
My boss is a very coniving person who BCCs our Managing Director on all e-mails especially potentially contentous ones. Is there no way I can reply to my to my boss that will enable all the BCC recipients to see my response, therefore providing the whole picture and not just one side of the story?
Itzy Sabo // April 22, 2007 at 8:22 pm |
Vanessa: unfortunately, when you reply-to-all, you are only replying to the people who are publicly associated with the original message. Your email program is totally unaware of who received a BCC copy, or even whether anyone at all was BCC’ed on the message. You’ll have to find another way to get your side of the story across. How about an anonymous blog? ;-) (WARNING – be very careful if you take the blog route – if it becomes too popular, and you make a careless mistake, you could end up getting found out…)
Vicki Davis // May 22, 2007 at 4:32 pm |
Yes, this can be embarassing and may damage relationships, diminish trust, create more work and reduce your ability to make decisions. It’s time to get human again. Replace the screen-time with face time.
Mark Smalley // July 18, 2007 at 10:57 pm |
HI….I was bcc’d on an e-mail and was wondering if it is at all possible to determine who else…not an address really…just if there was another recipient besides myself..?
Itzy Sabo // July 20, 2007 at 12:22 pm |
Mark: there’s no way to know even whether BCC was used, unless you yourself are a BCC recipient. Even then, you cannot know if you were the only BCC recipient.
Mark Smalley // July 26, 2007 at 6:57 pm |
Thanks Itszy….I found this on line….wuold this apply for a work server? …does this ring true?
“….Note there is a potential security flaw in the BCC feature. According to the conventions of the SMTP protocol, all addresses, including BCC addresses, are included in every email as it is sent over the Internet. The BCC addresses are stripped off blind copy email only at the destination email server. Therefore, if the addressee controls their email server or can access it, they could examine the BCC addresses on every email they receive.
palehorse // July 26, 2007 at 8:07 pm |
UGH! I was just bit by this one. I read this article quite a while ago and have since changed my habits however; a co-worker uses BCC to the point of annoyance. I frequently get BCC’d on emails contents that leave me scratching my head due to the lack of context. Upon returning from vacation as I was sorting through my week of email I accidentally replied-to-all to ask him what the email was about. Ugh!
Now to fix the problem… *sigh*
Itzy Sabo // August 3, 2007 at 6:51 am |
Mark: I do not believe it is true for all cases. I am by no means an expert in the technical aspects of SMTP, but as far as I understand, a mail server that receives a message for delivery, will receive a list of recipients. So within your company, your mail server will know who all the recipients are, including the BCC recipients. However, if you receive a message from outside your network, your mail server will only know about the recipients it was asked to distribute the message to, i.e. those within your company. Other mail servers will have been asked to distribute the message to the recipients not under control of your mail server.
Whether or not I am correct, most people cannot access the mail server’s logs to see how specific messages were handled — this itself would be considered a breach of security.
Four (or Five!) Reasons Why » …The “Reply All” Button Must Die // November 30, 2007 at 2:00 pm |
[...] Almost as bad a the BCC (or Blind Co-Conspirator), “reply all” creates a “cover your ass” culture. A single email filed [...]
Sunil Shah // February 6, 2008 at 4:59 pm |
How can stop my Exchange 2007 STOP delivering messages to persons listed in the BCC field ? This should ONLY apply to messages sent from within my domain. Thanks.
Mix // March 14, 2008 at 5:49 pm |
hey everyone i got a Q… ” As a reciver of an e-mail, can i find out if the sender BCC anyone ?
Itzy Sabo // March 15, 2008 at 7:10 pm |
Mix: Not unless one of the BCC recipients Replies-to-All by mistake.
Faisal // March 20, 2008 at 1:08 pm |
What a great discussion,
My boss sends emails to be with a different tone sometimes, like he is BCCing someone.
How can I find out who did he BCC??
why me? // May 8, 2008 at 8:55 pm |
what was I thinking? I’m somewhat new to my organization (been here about a year), having been hired in from outside. I recently sent an email to one of my employees asking why he didn’t trust me, stating we’re all in this together, along with the typical motivational, team-building comments.
As the email came about because of specific issues that needed to be addressed, I wanted my supervisor to be aware of it. So….I BCC’d him.
think about it…. a BCC on an email telling someone he needed to trust me! What was I thinking? Fortunately my supe didn’t ‘reply-to-all’. That would not have been pretty!
Itzy Sabo // May 9, 2008 at 11:54 am |
“why me”: it sounds like it would have been better to have a face-to-face discussion with your employee. Email is not a good medium for some things, see Don’t write to me in that tone of voice!
Ken E // November 6, 2009 at 9:39 pm |
Is there a method to see who all the addressees are when you receive an “undisclosed recipients” e mail, i.e. everyone has been BCC’d?