The advice to give every account its own email address is easy to follow right up to the point where you reach your bank. Retail sites, newsletters and forums are low stakes. If one of those addresses stops working you lose a discount code. A bank is different, because the address on the account is not only a mailbox. It is a security control, a recovery channel, and part of how a human being on a telephone decides whether you are you.
An account alias is an additional address that reaches a mailbox you already have. Microsoft's description of the feature is the clearest short version: an alias uses the same inbox, contact list and account settings as your primary address, and every alias signs in with the same password. Forwarding aliases work slightly differently, since they relay mail to a mailbox held somewhere else rather than opening a second door onto the same one, but from outside they look identical. Mail arrives, and a reply goes back with the alias as the visible sender rather than your real address. Reply all is the exception worth knowing: only the path back to the original sender is rewritten, so everyone else on the thread receives your reply straight from your real account. If the concept is new, what an email alias is covers the mechanics.
The honest answer here is not the one an alias provider usually gives. The upside for banking is real and larger than most people assume. The downside is rarer than people assume and considerably worse. For a lot of readers the sensible position is to alias almost everything and leave the bank on the address they have had for years. Both sides are worth setting out properly before you decide.
The upside is a phishing test that cannot be argued with
Standard phishing advice asks you to look at things. Check the sender address for near misses, check the spelling, check whether the tone feels off. The UK's National Cyber Security Centre is blunt about how far that gets you now, warning that "scams are getting smarter and some even fool the experts". Display names are trivially forged, lookalike domains are cheap, and the HTML in a good phishing email is usually copied from the genuine article.
A unique address replaces judgement with a fact. If the only address your bank has ever held is one you created for that purpose and gave to nobody else, then a message claiming to be from your bank that arrives at any other address of yours is fake. You do not need to read it, hover over the link or inspect the headers. It failed before the content mattered. That is a stronger signal than any amount of studying a sender name, because it does not depend on the attacker being sloppy. A pixel-perfect forgery sent to the wrong address of yours is still instantly, provably wrong.
The same address works as a leak detector in the other direction. If mail from anyone other than the bank starts arriving at an address only the bank was given, something has escaped, and you know exactly where from. That is the useful half of working out who leaked your address, and it is much harder to do when one address is on four hundred sites.
Two limits are worth stating. The test only holds while the real address is genuinely absent from the bank's records and not easy to find elsewhere, so it degrades as soon as you use the old address for a support ticket. And it does nothing at all for the channel where most banking fraud actually starts, which is the telephone and SMS. An alias tells you a message is fake. It does not tell you a caller is.
The real risk is recovery and support, not day to day delivery
Forwarding a statement notification is easy. The trouble starts on the days when something has already gone wrong. Telephone agents routinely ask you to confirm "the email address on the account" as one of several identity checks, and you will be reading it aloud, letter by letter, possibly from a foreign country while your card is blocked. An address like acct-7f2b@ is fine on a web form and awful under those conditions. Whatever else you do, an alias attached to a bank should be a word a person can spell back to you.
Then there is the hop itself. A forwarding alias adds a machine between the sender and you, and machines have opinions. Gmail's own documentation on automatic forwarding says plainly that it forwards all new messages "except for spam", so anything the first mailbox misfiles is quietly not passed on. Google's admin guidance for SPF is equally direct that forwarded messages can still fail authentication checks because of the way the forwarding server handles them, which means the second mailbox may take a dim view of the relayed copy even when the first one did not. Both failures are silent from where you are standing. The bank's log says the message was delivered.
Changing the address afterwards is the part people never plan for. NatWest's published guidance is a fair example of the shape of it: to change your email in branch you need your debit card and PIN or proof of identity, and the online route asks for your log in details plus a card reader or biometric approval. Every one of those routes assumes you can still authenticate, which is precisely what you cannot do in the situation where the address matters most. Some providers are stricter still, and a few will not move the address on certain account types without you turning up in person.
The lockout, written out properly
It runs like this. You are travelling. Your phone is lost or stolen, which takes your authenticator app and your SMS with it. You get to a borrowed laptop, try to log in, and the bank offers to email a one time code to the address on the account. That address is an alias. The alias points at a mailbox you no longer control, or sits on a domain whose renewal failed against an expired card, or belongs to a service that suspended your account for non payment, or was tidied up during a spring clean six months ago because you did not recognise the name.
The code goes out. It bounces, or it lands in a spam folder you cannot reach, or the address simply refuses it. Apple's documentation for its own alias feature is a good illustration of how final this can be: once you stop using one of its addresses, mail sent there is returned to the sender. You call the bank. Support can send the code to the address on file and nowhere else, because sending it somewhere new is exactly what an attacker would ask for. To change the address on file you need to pass identity checks that route through the address, or attend a branch, and the branch is in another country.
This is not a common outcome. Most people who alias a bank account will never see it happen. But the distribution is what matters rather than the average. The cost of the good case is a slightly tidier inbox. The cost of the bad case is losing access to your money during the week you most need it, and every step of the recovery path was designed to be difficult for someone who is not standing in front of a cashier.
What makes the risk manageable
If you decide the phishing benefit is worth having, four things move this from reckless to reasonable. None of them is optional.
- Use an alias on a domain you own, not a shared provider domain. On your own domain the address survives the provider. If you fall out with the service, stop paying, or the company closes, you repoint the DNS and the address keeps working. On a shared domain you keep the address only for as long as you keep the relationship, which is a strange thing to hang a bank account on. A custom domain for aliases is the whole difference between an address you rent and one you hold.
- Keep a written record of which address goes where, stored somewhere you can reach when you are locked out of everything else. A note inside the mailbox you cannot open is not a record. Paper in a drawer, or an export in a password manager you can reach from a borrowed device, is.
- Never leave a disabled, deleted or expired alias attached to a live account, and set the domain to auto renew years ahead on a card that is not the one likely to be cancelled. Use a specific alias rather than relying on a catch-all address for anything financial, because a catch-all quietly turns a domain problem into a total loss of every address at once.
- Test that mail actually arrives before you rely on it, and test the whole path. Trigger something the bank really sends, a statement notice or a password reset, then check the spam folder at every hop rather than only the final inbox. Repeat it once a year. A forwarding chain that worked in March can stop working in November without telling anyone.
Two smaller habits help. Where a bank allows a second contact address, put a plain mailbox you control directly in that slot, so there is one path with no forwarding in it. And keep an eye on whether the alias is holding up under real use, because a bank that starts landing in spam is telling you something about the hop, not about the bank. If a signup form rejects the address outright, that has its own causes and fixes.
A tiering rule, lowest stakes first
Work upward. The point of the order is that you prove the machinery on things that do not matter before it holds anything that does.
- Tier one, no money and no identity. Newsletters, forums, one off downloads, retail browsing, free trials. Alias everything, always, without thinking about it. The worst case is that you lose a mailing list.
- Tier two, a card on file but nothing irreplaceable. Streaming, food delivery, loyalty schemes, online shops with saved payment details. Alias these freely. If forwarding breaks you get an annoying afternoon of resetting a password, not a crisis.
- Tier three, real consequences but a human route back. Utilities, insurance, your mobile carrier, employer systems. Alias these only on a domain you own and only once they are written down. Treat the mobile carrier with particular care, since that account is the recovery channel for a great many others.
- Tier four, money and identity together. Current accounts, savings, brokerage and pensions, the tax authority, and the mailbox that acts as recovery for everything else. This is where the boring answer earns its keep. Use the address you have had for years, the one that will still exist if every subscription you hold lapses.
Spend a year in tiers one and two before you go near the top of the list. If the forwarding path has survived twelve months of real traffic, including the awkward senders, you know something about it. If you have not tested it, you know nothing, and a bank is a poor place to find out.
What we would actually do
Real address for the primary current account, the brokerage and the tax authority. Alias for absolutely everything else, including second tier savings accounts where a re-verification would be irritating rather than dangerous. That split keeps almost all of the phishing benefit, because the real address stays off the open market and out of the breach corpus, while the one or two accounts that can genuinely hurt you keep the shortest possible delivery path.
It is worth being plain about why. Adding a forwarding hop adds a failure mode that did not previously exist. Direct delivery has one system that can break, and it is the one your bank already tests against. Forwarding has three, and two of them are yours to maintain. That trade is excellent when the downside is a missed newsletter and poor when the downside is a one time code you never received. For anything where a missed message is expensive, the boring answer is the real address.
If you do alias the bank anyway, and plenty of people reasonably will, make it an address on a domain you own, readable aloud, written down offline, tested annually, and never the only contact route on the account. Do that and the phishing detection is close to free. Skip any one of them and you have swapped a small, constant risk for a rare, expensive one.