Gmail forwarding

The feed that needs no app, and works on any phone. Your bank emails you a credit alert; a Gmail filter forwards those alerts — and only those — to an address that belongs to your account.

Your ingest address is in Settings. It looks like m followed by 32 hex characters, at the domain shown there — it is unique to your account, and it is how we know whose money we are looking at.

Set it up

1. Add the address as a forwarding address. Gmail → Settings → Forwarding and POP/IMAP → Add a forwarding address. Paste your ingest address.

2. Confirm it. Gmail sends a confirmation mail to that address. It arrives at us, and the confirmation link appears in your dashboard Settings → Gmail forwarding. Click it there.

3. Create the filter — and scope it tightly. Gmail → Settings → Filters and Blocked Addresses → Create a new filter.

From	alerts@hdfcbank.bank.in
Action	Forward it to your ingest address

Do not set this to forward all mail. The filter should send us bank credit alerts and nothing else. We parse in memory, keep only what a matched or parked credit needs, and never retain a raw message body — but the right place to limit what we see is the filter, before anything is sent.

4. Send yourself a small test payment. The first verified credit binds your account’s last four digits. After that, a credit for any other account is rejected rather than matched, so a stray forwarded alert can never confirm one of your orders.

Is forwarding safe?

Yes, and here is the actual reason.

Anyone on the internet can send mail to any address, so an ingest address is not a secret and is not treated as one. Every message is checked for a valid DKIM signature from the bank’s own domain, and only a signature verified by our own mail infrastructure counts — a header some other server wrote saying it checked is ignored. DKIM signs the message body, and Gmail forwarding does not modify the body, so the bank’s signature survives the trip.

SPF does not survive forwarding — that is what forwarding is — so SPF plays no part in the decision. HDFC publishes a strict DMARC policy, which is what makes the DKIM anchor worth having.

A message that fails that check is rejected outright. Nothing is stored.

Timing

The delay between your bank sending an alert and it reaching us through Gmail is not something we control, and we have no measured figure for it. It is the one number in this system we cannot quote.

We do not let it become a correctness problem. A credit that reaches us more than 30 minutes after the bank’s own timestamp is parked as stale rather than matched, and a message that arrives with no usable timestamp at all is parked too — we never fall back to “the time we received it”, because that once confirmed a 90-minute-old payment against a fresh order.

If latency matters to you, run the reporter app as well. The two feeds deduplicate on the bank’s reference number, so running both costs nothing and the faster one wins.

Other banks

HDFC only, for now. The parser is built to take more — it is keyed on the sending domain and each bank is a separate module with its own test corpus — but only HDFC has one.