A separate email for bills and utilities is a forwarding alias belonging to one biller, in use for the whole life of that account, carrying statements, payment reminders and account notices. Bills repeat every month, so the address handles dated mail, from password resets to disconnection warnings. The bank stands outside the method: its address is a permanent real dedicated address, never a masked or relay alias.
One shared bills inbox leaves every biller holding the same address, and a leak at one supplier exposes it to the rest. A different alias per biller contains a leak to the supplier that held the exposed address. Utility and telecom suppliers store customer email addresses in large databases, and breaches of those databases in 2024 and 2026 supply the evidence.
The address on a utility account
One address on a utility account performs several jobs at once: it receives the monthly statement, the payment reminder, the direct debit confirmation, the password reset link and the disconnection warning, and it serves as the login name on many utility portals. Most households hand the same personal address to the electricity, gas and water suppliers, the broadband provider and the mobile carrier, and the address then sits in each customer database and in the databases of the marketing platforms and email distribution services they use. A breach at any one of them exposes the same address, and the spam that follows gives no indication of which company leaked it. Spam arriving on the electricity supplier's alias names that supplier.
Utility and telecom breaches, 2024 to 2026
A dataset with personal information on about 73 million people appeared on a forum in March 2024. AT&T confirmed coverage of about 7.6 million current and 65.4 million former account holders, with data from 2019 or earlier, and reset passcodes for those 7.6 million customers (SC Media report). Troy Hunt counted 73,481,539 lines in the leaked file, with 49,102,176 unique email addresses (Troy Hunt analysis). The file also held names, addresses, phone numbers, dates of birth, account numbers and passcodes. AT&T has not established whether the data came from its own systems or a vendor (Security.org summary). A second AT&T incident, disclosed on 12 July 2024, covered call and text records of nearly all wireless customers from May to October 2022, with no call or text content (TechCrunch report).
Southern Company disclosed on 5 October 2026 that unauthorised access to its online customer portal had affected about 400,000 customers of Georgia Power, Alabama Power and Mississippi Power, exposing names, contact details and the last four digits of Social Security numbers (SecurityWeek report). The full incident is covered separately (Southern Company breach analysis). ENGIE confirmed on 27 October 2026 that attackers stole customer data from a marketing platform used by its business partners in France. Its internal IT systems were not compromised and no banking data was affected. Notification letters listed names, mailing and email addresses, phone number, delivery point or metering point identifiers, customer ID and contract number. ENGIE published no victim count (BleepingComputer report).
Arara Message and the distribution list
Paycloud Holdings reported on 2 November 2026 that unauthorised access to Arara Message had taken or may have taken about 77 million email addresses from 97 servers (Japan Times report). Arara Message is an email distribution service for up to about 380 client companies. The service sends newsletters and account notices for its clients, so one compromise exposed hundreds of brands' subscriber lists at once. The count is of email addresses, not people, and Paycloud describes it as preliminary (TSN report).
Hokuriku Electric, one of the clients, announced on 2 November 2026 that about 550,000 email addresses from its Hokulink member service were exposed through unauthorised access to the contractor's email distribution platform between 28 and 31 October 2026. No other personal data was affected (Hokuriku Electric report). The full Arara incident is covered separately (Arara Message breach analysis). The Hokuriku figure rests on a news summary of the announcement, not the company's own English-language notice. Attackers also used the service to send up to about 7.13 million emails posing as a credit card company between 28 and 30 October 2026. The messages carried genuine authentication because they passed through the legitimate sending platform. A list pairing an address with a name and a brand makes the next message more convincing.
One alias per biller
One alias per biller, rather than one bills inbox, follows from these cases. A shared bills inbox leaves every biller holding the same address, so one leak exposes it to every other biller's mail, while a separate alias fixes the attribution: spam aimed at the electricity supplier's alias names the supplier, and the other billers' mail keeps arriving. Forwarding supplies the mechanism: the alias passes mail to the real inbox and the biller holds only the alias, so the real inbox address never appears in the biller's database or breach. The mechanism is explained in general terms separately (what an email alias is), with forwarding covered alongside it (how email aliases actually work).
The alias has to stay alive for as long as the account exists, because bills recur monthly and the address carries statements, payment reminders and password resets for the life of the account. An alias that stops working while the account is live strands it: password resets go nowhere and disconnection warnings never arrive.
The alias therefore remains in use until the account closes or the biller moves to a fresh alias, and the same condition holds for other long-lived accounts. A second inbox on its own is a weaker version of the same idea (do you need a second email address). A leaked alias is handled by moving the biller to a fresh alias and then stopping the old one, in that order: the portal has to hold the new address before the old one stops, or statements and resets will be lost in between. Utility portals generally allow the email address to be changed in the online account; Octopus Energy states that customers can update their email in their online account (Octopus Energy contact page).
Financial accounts and the bank exception
The bank receives no alias. Its address is a permanent real dedicated address used only for financial accounts, never a masked or relay alias, because recovery, statements and fraud alerts travel through it and it needs to stay tied to a verified identity. A masked address is built to be changed or abandoned, which breaks recovery at the point it matters most. The full argument is set out separately (should you use a separate email for banking).
A utility bill is a recurring payment, but the utility account does not hold the money, while the bank holds it and verifies identity under regulation. A leaked utility alias can be replaced, because the account moves to a fresh alias and the payment method is re-entered. The bank address cannot be replaced in the same way, because recovery, statements and fraud alerts all depend on it.
Government guidance points the same way: the Hong Kong government's InfoSec site lists as a standing recommendation: "Do use separate email addresses for different purposes whenever feasible" (InfoSec guidance). India's CyberDost, the cyber safety handle of the Ministry of Home Affairs, advised the public to keep one email account for trusted communication and financial transactions and a separate account for social networking registrations (Times of India report). No regulator was found publishing guidance specific to email addresses for utility bills, so the guidance cited here is general rather than utility-specific.
Paperless billing and the phishing test
Paperless billing leaves email as the only route for the statement. SSE Energy Solutions recommends paperless bills where possible, and warns that criminals send phishing emails that look like they come from a bank or a utilities supplier (SSE guidance). A message quoting a real account number, service address and bill amount reads as genuine; a disconnection threat adds urgency.
A per-biller alias gives the recipient a channel test. Mail claiming to be from the electricity supplier, arriving on an address the supplier never held, identifies itself as forged. Mail arriving on the right alias can still be forged, so the sender domain still has to be checked and the account opened through the supplier's own site or app. A separate alias does not stop phishing or a breach at the biller; it limits the damage to one biller and names the source.
The NDSS 2026 study tested 28 email providers and 18 online platforms and found only Gmail fully documents its aliasing rules, while 11 providers silently support undocumented alias behaviour. In the user study, 31.65% of participants with alias knowledge mistook phishing emails as legitimate alias mail: the alias in the message matched the one they expected (NDSS 2026 paper). The alias is a filter rather than a verdict: a match between the address in the message and the address on file does not establish that the sender is genuine.
Administrative cost and other limits
A separate email for bills does not protect the other data the biller holds: a breach exposing names, service addresses, account numbers and payment details is not contained by an alias. The arrangement also adds a small administrative cost: each biller holds a different address, the owner keeps a record of which alias belongs to which biller, and if the forwarding service stops, every alias stops with it. The steps after a breach are set out separately (what to do when your email is in a data breach).
The inbox itself still needs a unique password and two-factor authentication, because every biller reset flows through it. A check on whether an address has been leaked is also available (how to check if your email was leaked). The general case for a different address for every website is set out separately (different email for every website); delivery notifications carry the same logic for parcels (how to protect your email for delivery notifications). No utility was found publishing a policy on accepting alias addresses at signup, so whether a given biller accepts an alias at registration is untested here.
AliasFleet and bills
AliasFleet provides forwarding aliases that stay active for as long as the account holds them, with a separate alias per service and a pause control on each alias, and a biller holds only its own alias while the real inbox address is not given to the biller. If an alias starts receiving spam, it can be paused once the biller has moved to a fresh alias, and the other billers are unaffected. AliasFleet does not provide an address for a bank account: the bank gets a permanent real dedicated address, and aliases are for everything else.
Top comments (0)