What can BCC information show, and who may hold it?¶
title: What can BCC information show, and who may hold it? subtitle: Blind-copy recipients are deliberately hidden from ordinary recipients, so the copy you examine may not contain the full recipient list. slug: what-can-bcc-information-show-and-who-may-hold-it series: email-evidence section: technical-interpretation card_type: question_card pathway_order: 19 section_order: 6 status: draft public_safe: true video_ready: true word_count: 531 estimated_read_time_seconds: 220 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - BCC - recipients - headers - provider records sources: - title: 'RFC 5322: Internet Message Format' url: https://www.rfc-editor.org/info/rfc5322/
What can BCC information show, and who may hold it?¶
Blind-copy recipients are deliberately hidden from ordinary recipients, so the copy you examine may not contain the full recipient list.
Script¶
You need to know whether somebody was blind copied into an email.
The ordinary recipient’s copy may not tell you.
BCC means blind carbon copy.
It allows a message to be delivered to an address without revealing that address to the other recipients.
The Internet Message Format standard permits email systems to handle BCC in several ways.
The sending system may remove the BCC field before distributing the message.
It may create a separate version for blind recipients.
It may include only a particular blind recipient’s address in that recipient’s copy.
It may even leave an empty BCC field indicating that blind copies existed without identifying them.
So there may not be one identical header shared by every recipient.
The copy held by a visible To or Cc recipient will normally not reveal the blind recipients.
A blind recipient’s copy may reveal their own BCC status.
It may not reveal every other person who also received a blind copy.
That means you can’t safely examine one recipient’s header, see no BCC field and conclude that no blind copies were sent.
Start with the sender’s side.
The sender’s Sent item may retain information about the recipients selected at the time of sending.
An organisational mailbox, archive, journal or compliance system may preserve another version.
The sending provider may hold envelope-recipient or message-trace records showing which mailboxes the service attempted to deliver to.
A mailing platform may hold campaign-recipient records.
The exact source depends on how the message was sent.
Then check the recipient side.
A person suspected of receiving a blind copy may hold their own version of the email.
Their provider may have a delivery record even when their address doesn’t appear in the message shown to other recipients.
Another recipient’s mailbox may help reconstruct the different versions distributed by the sending system.
Preserve each native message separately.
Don’t assume that two copies with the same Message-ID are byte-for-byte identical. BCC handling may produce different recipient-specific versions, and delivery systems may add different trace fields.
Also distinguish the visible message header from the SMTP delivery envelope.
The To and Cc fields are part of the message content.
The actual delivery process may include recipients whose addresses don’t appear there.
BCC is one reason.
Mailing lists, forwarding, aliases and redirection can produce similar differences.
The common mistake is:
“The address isn’t in To or Cc, so the person didn’t receive the email.”
Another is:
“This BCC recipient’s copy lists one blind address, so that must be the complete BCC list.”
Neither conclusion follows automatically.
A careful finding might say:
“This recipient’s copy doesn’t display any blind recipients. The sending provider’s records show that the message was also delivered to these additional addresses.”
Or:
“This mailbox contains a recipient-specific copy identifying this address in BCC, but the available message doesn’t establish whether other blind recipients existed.”
BCC can be highly relevant.
It may show hidden distribution, undisclosed knowledge, an attempt to keep somebody informed or the spread of sensitive material.
But the evidence often sits with the sender, provider or blind recipient rather than in the copy held by everybody else.
Treat BCC as a delivery-record question, not simply a missing header field.
Key takeaway
The absence of a BCC address from one recipient’s header doesn’t prove that no blind copy was sent.
Related questions¶
- How do I preserve and interpret a complete email header?
- Should I preserve the mailbox as well as the individual message?
- Who may hold relevant email records?
- How do I establish whether messages really belong to the same email thread?