Guidance for Recipients of Secure Email Messages from Lloyds Banking Group Version: 1.3 Last updated: 14/04/2016
1 Introduction This user guide is intended for third party email users users who receive, and reply to, secure emails from Lloyds Banking Group. This document will guide you through the use of the Lloyds Banking Group secure email service. You may also see this referred to as encrypted email. Lloyds Banking Group takes email security very seriously. Using a secure email solution provides an added layer of protection to minimise the risks of interception and misuse of confidential information. Lloyds Banking Group s Information Security policy mandates that confidential electronic information exchanged with external parties must be encrypted. The Bank uses the Symantec Secure Email (PGP) system to deliver secure emails as a PDF document. The PDF document is opened with a password to allow you to read the original email, and any attachments. No special encryption software is required and you only need Adobe PDF reader installed on your PC. If you have Symantec Secure Email (PGP) software already installed on your PC and have exchanged keys with Lloyds Banking Group, or you use TLS (Transport Layer Security) to receive emails, then these notes do not apply to you. Page 2 of 13
2 How Secure Email works The Lloyds Banking Group secure email service has changed recently. How it used to work: When you were sent an encrypted email by Lloyds Banking Group you received a notification email advising you that a secure email is waiting. A link in the email would take you to a secure web portal where you used a password to log in. Once in the portal you read the original email securely, and replied securely, in similar manner to using a Gmail or Hotmail web email account. How it works now: 1. When you are sent an encrypted email by Lloyds Banking Group for the first time you will receive a notification email asking you to register with a secure web portal to establish a password. 2. Once registered, or if you have used the service previously, you will receive a notification email with a PDF attachment. The PDF file will contain the original email, and any attachments sent with the original email (such as Word, Excel and PowerPoint documents), 3. When you open the PDF you will be prompted for a password. This is the password you have just created, or have already been using if you are an existing secure email user. Once you have opened the PDF you will see the body of the original email and any attachments sent with the original email. 4. To reply securely you must first log in to a secure web portal, again using the password established previously, to compose and reply to the sender. This is unchanged. If you don t need to reply securely you can reply to the email in the normal manner. 5. This type of email is sometimes also referred to as Symantec PDF Protected email, PDF email or simply secure email. Any emails you send from the secure web portal will expire and be deleted after three months. Similarly, unused accounts will also be deleted after three months. You will be automatically disconnected from your secure mailbox after 15 minutes of inactivity. Page 3 of 13
Prerequisites 1. You must have a web browser connected to the internet. Supported browsers are: o Windows: Internet Explorer 9 -> 11 and Firefox 20 -> 23 o Mac OS X: Safari 5.1 -> 6.0 and Firefox 20 -> 23 2. You must have Adobe PDF reader, V7.0 or above. There will be a link in the advice/notification email giving you an opportunity to download the latest version of Adobe PDF reader. 3. You should make sure that emails from lloydsbanking.com are white-listed" on any spam filters, either within your email/webmail client, by your local IT support team or by your ISP (in other words, you can receive emails from Lloyds Banking Group successfully). 4. Your email system must be able to receive emails with encrypted (password protected) PDF attachments. 5. You should use a desktop or laptop to view your secure email. Mobile devices (phones and tablets) can be used in some cases but are not always reliable when viewing attachments in PDF files. 6. First time users should check that you can access the system by entering the following address into your web browser address bar: https://securemail.lloydsbanking.com You should see a screen similar to the following displayed in your browser. If you get any error messages or the screen is not displayed then you will need to contact your local IT support team to investigate. Lloyds Banking Group is unable to diagnose connection issues at a third party company. Page 4 of 13
3 Instructions Step by step instructions to receive and reply securely using the Lloyds Banking Group secure email service. Step 1. If you have not used the Lloyds secure email service before, then the first email you receive will request you to set up a password. From: Jones, Angus <angus.jones@lloydsbanking.com> Date: Thu, Jan 14, 2016 at 4:13 PM Subject: Request to set up a Lloyds Banking Group password for encrypted emails To: Margaret.Jones@acmegroup.com You have received an encrypted email: From angus.jones@lloydsbanking.com Subject: Query about order This is the first time you have received encrypted email from Lloyds Banking Group so you will need to set up a password (also referred to as a passphrase) to access this email and any future encrypted emails that you receive from us. To set up the password, please go to the Password Set-up Page, where you will see guidance on how to choose a strong password. Remember to ensure that your password is unique: never reuse passwords that you use to access other online services. You will receive a confirmation when your password set-up is successful and your encrypted message will be sent to your inbox. You must enter your password to read it. Lloyds Banking Group takes online security very seriously. If you have any questions or concerns about this email, please contact Jones, Angus (Lloyds Marketing) directly and they will be happy to answer any questions you may have. Step 2. Select Password Set-up Page to set up a password. Note that the Symantec toolset uses the term passphrase also. Page 5 of 13
Step 3. A confirmation message will indicate that the password has been correctly set up. From: SecureEmail <SecureEmail@lloydsbanking.com> Date: Thu, Jan 14, 2016 at 4:33 PM Subject: You have successfully set up a Lloyds Banking Group password for encrypted emails To margaret.jones@acmegroup.com Your password for Lloyds Banking Group encrypted emails has been set up successfully. You can now use your password to read encrypted emails you receive from us and to reply securely. You will need to use your password every time you receive and send encrypted emails. Step 4. Once a password has been set up then your secure message will be released. The sender s email, and any attachments, will be in the attached PDF file. From: Jones, Angus < angus.jones@lloydsbanking.com > Date: Thu, Jan 14, 2016 at 5:03 PM Subject: Lloyds Banking Group encrypted email To: margaret.jones@acmegroup.com You have received an encrypted email: From: angus.jones@lloydsbanking.com Subject: Query about order To read the email, open the attached encrypted PDF file and enter your password when requested. You will need Adobe Reader to view your email. If you don t have this, you can download it directly from Adobe. You can send a secure reply by clicking the Reply Securely button from within the PDF, or by going directly to the Lloyds Banking Group Email Protection portal. You can send secure email directly from the portal if you wish. Lloyds Banking Group takes online security very seriously. If you have any questions or concerns about this email, please contact Jones, Angus (Lloyds Marketing) directly and they will be happy to answer any questions you may have. Page 6 of 13
Step 5. Open the PDF file by double- clicking on the attachment. You will need to enter your password setup in step 2. If you have used secure email before, then your password will be unchanged. Step 6. To reply securely the Reply Securely button will take you to the secure web portal below. You will first be required to login. Page 7 of 13
Step 7. Once in the secure web portal, you can compose and send emails securely to the Lloyds Banking Group colleague you have been working with. Step 8. The settings option will let you change options and your password. Unless you have PGP installed on your PC and wish to exchange keys, you should leave these options unchanged. When you have finished using the Symantec Web Email service, you should click Logout. Page 8 of 13
4 FAQs Q: How is secure email received? A: An email encrypted by the Symantec Secure Email (PGP) system is received as an encrypted PDF file, attached to a notification (or advice) email. When you open the encrypted PDF file it will first prompt you for a password. The PDF file will contain the body of the original email message and any attachments from the sender such as Excel or Word files. Attachments from the sender can be easily saved unencrypted outside the PDF file, although the PDF file will remain encrypted. This encryption cannot be removed. Q: What is a PDF file? A: A PDF (Portable Document Format) is a file format like Word or Excel that is widely used for sharing data within, and between, organisations. The PDF standard is owned by Adobe Corporation. PDF files can also be encrypted (password protected) for security. Q: Do I need any software to read a PDF file? A: The only software required to read secure emails is an Adobe PDF reader v7.0 or above, or an equivalent PDF reader. This is standard, free software that most recipients will already have but a link in the email will allow you to download the latest Adobe PDF reader if needed. There are many software applications that can open a PDF file but only the Adobe software is certified to work with Symantec Secure Email (PGP). Q: Can I receive emails directly on to the secure web portal? A: No. This has changed recently. You may have received email in the past on the secure web portal, and these will still be accessible but, going forward, emails will be received as encrypted PDF files directly into your corporate inbox. Any existing emails you may have already in your secure web portal inbox will expire in three months, as is the case now. Q: What happens if I forget my password? A: You can reset the password yourself via the link I lost my Passphrase on the secure portal log in screen (see step6). This will result in an email, with reset instructions, being sent to your email address. This has immediate effect. Please be aware that any secure emails already received, and specifically the encrypted PDF file, remain encrypted to the previous password (i.e. the password in use at the time the email was sent). If you need to read an old email, and you don t have the password that was used to protect the PDF file, then you will need to ask your contact in Lloyds to resend the email. Note that passwords are also encrypted and cannot be read or recovered by Lloyds Banking Group staff. Q: Password or Passphrase? A: Symantec uses the term passphrase but Adobe, who own the PDF file system uses the term password, as does Lloyds. In practical terms it is the same thing. Page 9 of 13
Q: What are the advantages of PDF Protected email? A: Since emails are sent directly to your corporate inbox on a PC or device, there is no limit to the number and size of emails you can receive. Previously there was a secure web portal mailbox limit of 20MB. Word, Excel and other attachments in the sender s email can be easily and directly saved onto your PC or folder structure. Q: What are the disadvantages of PDF Protected email? A: You must not forward PDF Protected emails as they will remain password protected and you must not share your password with anyone. Also, should you wish to use the secure reply facility, please note the communication takes place within the secure web portal environment and these emails cannot be saved locally. Q: How do I unlock my account? A: If you type your password incorrectly five times, your account will be locked. You will be sent an automated message with a link allowing you to reset your password. If you do not receive the message, please remember to check junk or spam filters and ask your local IT support team to check their internet mail gateways as it may be that the mails have been rejected by them. This can happen because the mails contain links/urls and pictures so can be incorrectly flagged as spam. Q: I can t see any attachments when I open the PDF file A: Check your t PDF reader. There are many PDF readers freely available from other companies and most work well but some do not display attachments in PDF files correctly. The best approach is to make sure you have an up-to-date Adobe PDF reader (v7 or above). Most platforms are supported although there is a known problem with Windows mobile devices (e.g. phones and tablets) (see Known Problems). Note that the default PDF viewer that comes with Windows 10 does not support PDF files with attachments. In this case the safest option is to use a Adobe PDF reader. Q: I can t see my email in my sent items folders A: Emails are only saved in the secure web portal sent items folder if you are replying to a PDF email (i.e. you have clicked on a link in the email notification, or used the Reply Securely button in the PDF attachment). If you create a new email in the secure web portal, then emails will not be saved in sent items (see Known Problems) Q: Can I use Blackberry or Good to receive Symantec Secure Email (PGP) encrypted emails? A: No. Blackberry and Good are not supported by this secure email service. Page 10 of 13
Q: I have received a.zip file but I can t open it A: By default, PDF readers will not allow you to open and save.zip files that have been sent as attachments within a PDF file. This is a PDF security restriction. The same restriction applies to other files such as.exe or.bat files. You will have received an warning message like the one below: There is a workaround but it requires you to change your computer registry settings. (https://www.adobe.com/devnet-docs/acrobatetk/tools/appsec/attachments.html). If you can t do this you will need to ask the sender to resend the email without these types of attachments. Page 11 of 13
5 Known problems 1. Multiple sessions Note that you can only have your secure web portal session open on one computer at a time. If you try and access the same mailbox from a separate workstation or another browser window on the same workstation at the same time, you will get the following error message: If you do not log out of the secure web portal correctly, this can also result in this error. In this case you will need to wait 15 minutes for the session to time out. 2. Windows mobile devices. Secure emails can be received on most mobile devices, such as mobile phones and tablets, as long the correct version of Adobe PDF reader is installed. The exception is Windows mobile devices. Whilst the PDF file can be opened and read, any attachments (sent in the original email such as Word or Excel documents) can t be seen. 3. Emails not saved in Sent Folder. If you compose a new message in the secure web portal, unrelated to any previous message then, once sent, the message will not be saved in the sent items folder. This is only a problem if you are not replying to an email. If you compose a message after having clicked on a link in the email notification, or used a link the Reply Securely button in the PDF file to respond to a secure message from Lloyds, then emails will be saved. When composing a secure reply to a message from Lloyds you should take care not to navigate away from the compose page before you send. If you click away from the compose email page, for example to check an item in the sent emails folder, then when you return the draft message you were working on will be lost. In this circumstance sent messages also will not be saved. Page 12 of 13
4. Message not found. In rare occasions you may see the following message when replying securely to a PDF email (e.g. you have clicked on a link in the email notification, or used the Reply Securely button in the PDF file). This occurs because of synchronisation delays in the Symantec Secure Email (PGP) system. If you get this message please try again. It could take up to 30 minutes. 5. Error 500: Cannot call sendredirect The message below can appear if you use the back button in your browser when navigating within the Symantec secure web portal. You should instead use the navigation buttons provided in the Symantec software wherever available.. Page 13 of 13