Hypersensitivity or hypervigilance? Reading the signals in email’s To, Cc and Bcc lines

Editor’s Note: RFC 5322, the Internet Engineering Task Force standards-track document that defines email’s message format, says the only difference between To, Cc and Bcc is how each is used. People read that use as a second message. A common convention treats a name in To as someone expected to act and a name in Cc as someone kept informed, so moving someone to Cc can turn an owner into an observer. Adding a colleague can signal sponsorship. Copying a supervisor can import authority, though five studies in a 2019 Journal of Business Ethics paper found that employees felt less trusted by co-workers who copied their supervisor, and two found the effect strongest when the supervisor was always copied. Leaving someone off from the start can signal that the person is not part of the work, and dropping someone from a Reply All can shift who knows what. Because email is easily misjudged, readers should avoid hypersensitivity and hypervigilance: one dropped name is noise, but a recurring omission may show who is not top of mind. The signals matter, so leaders should address email consistently and consider how each line may be read.

Watch whether organizations adopt stated addressing norms, starting with when a supervisor belongs on a thread, and whether the same names keep getting dropped from threads as meetings, credit and assignments move elsewhere. Watch, too, whether the same norms reach chat, since the University of Cambridge’s Judge Business School, in announcing the email-trust studies, said collaboration software such as Office 365 or Slack could carry similar trust issues. And because addressing patterns can become evidence, information governance and eDiscovery teams should watch whether email collections reach beyond the To and Cc recipients’ mailboxes when a blind copy matters. Under the Bcc methods RFC 5322 describes, those copies carry no record of who was blind-copied.

Industry News – Leadership Beat

Hypersensitivity or hypervigilance? Reading the signals in email’s To, Cc and Bcc lines

ComplexDiscovery Staff

The internet standard that defines the format of email messages gives To, Cc and Bcc the same form and, in its own words, “the only difference between the three fields is how each is used.”

How each is used has become a second message riding on the first, one that tells every recipient who owns the work, who is watching and who has been moved to the edge of the conversation. On paper the distinctions are modest. RFC 5322, an Internet Engineering Task Force standards-track document from October 2008, puts primary recipients in To and others in Cc, “though the content of the message may not be directed at them.” Bcc addresses stay hidden from the rest.

Organizations have built a social code on those plain definitions, and leaders, like everyone else, write in it at volume. Microsoft’s June 2025 Work Trend Index special report, which draws on anonymized Microsoft 365 telemetry and a worker survey, found the average worker receives 117 emails a day and skims most of them in under 60 seconds. Mass emails with 20 or more recipients rose 7 percent in a year, the report found, while one-on-one threads fell 5 percent. Microsoft sells the AI tools the report recommends, and the data excludes education and European Union tenants. In an inbox moving that fast, the address block tells a reader at a glance whether the message expects action, who else has been told and who has been left out. The harder question is whether a reader who notices a missing name is being hypersensitive or hypervigilant, or simply paying attention.

What the To line says about ownership

A common working convention is that a name in To means the sender expects something from that person, while a name in Cc means the person is being kept informed. Placing an executive in To rather than Cc can signal that the executive is expected to act or decide, and copying a colleague’s manager brings the manager’s authority into the exchange without a word about it in the body. Even the order of names can be read as a ranking.

In a 2006 study in the Journal of Computer-Mediated Communication, Karianne Skovholt and Jan Svennevig of the Norwegian School of Management BI examined how a distributed work group used email copies. Copies kept the group informed about work under way and helped senders “build personal identity and alliances,” they found. Copies to third parties could serve as social control, used to win compliance or to press the person addressed to conform to norms of conduct. That last finding raises the question of what one familiar kind of third-party copy, the supervisor on Cc, does to the people receiving it.

Copying the boss carries a trust cost

A team including first author Tessa Haesevoets of Ghent University tested that question across six studies published online in the Journal of Business Ethics in 2019. The University of Cambridge’s Judge Business School said the studies were led by David De Cremer, then a professor there. The first study found that copying people in raised perceived transparency but also created a sense of increased control. The five studies that followed found that the use of Cc lowered how trusted employees felt, and in scenario-based experiments employees felt trusted least when a co-worker always copied the supervisor. Two field surveys tied that loss of felt trust to lower psychological safety and to a culture of fear.

Announcing the research in April 2017, two years before the journal paper appeared, Cambridge Judge said it drew on over 900 office workers in the United States, the United Kingdom, China and the Netherlands. The results held among Western and Chinese employees alike, the school said, so the effect did not appear confined to one business culture. Even good-faith copying, such as looping in a supervisor to get a broader view, fostered distrust among colleagues, according to the announcement.

“Too often, transparency is seen as an end in itself, but these studies show that including supervisors can make employees suspicious and prove counterproductive,” De Cremer said in the school’s announcement. He said the findings point to managers setting rules for when superiors belong on an email and stepping in when individual employees copy higher-ups too often.

Inclusion is a form of sponsorship

The same mechanics run in the other direction, because adding a person to a thread is a visible act. For a new hire, a peer from another function or a junior employee with the right answer, a name added to the To line publicly signals that the person is part of the work.

Leaders get more from that signal by explaining it, since a line such as “Adding Maria, who owns the vendor relationship” turns an address-line choice into an introduction. Credit can travel the same way. None of the studies cited here tested whether a copy carrying thanks lands differently from routine copying of a supervisor, but a note of thanks that copies a colleague’s manager puts recognition where it may affect that colleague’s standing.

Sidelining without a word

Inclusion has a mirror image. A person who led a thread can be moved from To to Cc, which turns an owner into an observer in front of peers. A sender can answer the deputy instead of the lead, address a group alias instead of the individual, or forward someone’s analysis onward without its author. Each move can be innocent, and each can also demote someone without anyone saying so.

Exclusion goes further. A colleague can be dropped from a Reply All partway through a thread, a decision can move to a parallel thread and be announced later, and a manager or human resources can be blind-copied on a dispute. Blind copies carry their own hazard. RFC 5322 warns that under one of the methods it describes, a blind recipient has no explicit sign of having been blind-copied, and could reply to all of the visible recipients and expose the fact that they received it.

Research on workplace ostracism helps explain why these quiet moves matter. Jane O’Reilly of the University of Ottawa, Sandra Robinson of the University of British Columbia’s Sauder School of Business and two colleagues compared ostracism with harassment in three field studies published in Organization Science in 2015. Employees judged ostracism more acceptable socially, less damaging psychologically and less likely to be banned by their organization than harassment. Yet ostracism was more strongly linked than harassment to a weaker sense of belonging and to poorer well-being and work attitudes. The research measured ostracism at work broadly, not exclusion from email in particular.

Ostracism is also easier to deny. According to the Association for Psychological Science’s account of the paper, the researchers wrote that a person who leaves someone out can more readily claim to have been too busy to respond or to have forgotten to include them. An address line offers exactly that cover.

“But abuse is not always obvious,” Robinson said in a university announcement of the study, describing people “who feel quietly victimized in their daily lives.”

Hypersensitivity or hypervigilance in reading the address line

The same deniability cuts the other way, because a dropped name is often no scheme at all. Autocomplete picks the wrong Chris, a reply from a phone loses half the list, and a busy sender trims a thread to the people who need to act. Readers are also worse at decoding email than they think.

In five experiments published in the Journal of Personality and Social Psychology in 2005, psychologists Justin Kruger, Nicholas Epley and two colleagues reported that people overestimate their ability both to convey tone by email and to read it. In one experiment with 30 pairs of undergraduates, as the American Psychological Association’s Monitor on Psychology described it, senders predicted their partners would read their tone correctly about 78 percent of the time. Partners who read those statements by email judged correctly whether each was sarcastic or serious about 56 percent of the time, which the Monitor called “not much better than chance.”

Kristin Byron, then at Syracuse University’s Whitman School of Management, reached a related conclusion in the Academy of Management Review. “A first step toward improving accuracy in emails is to recognize the possibility that we are fallible as both email senders and receivers,” Byron said when Syracuse announced the paper in February 2007.

That suggests a way past both hypersensitivity and hypervigilance, in which a single omission is noise and a pattern is data. The useful questions are whether the same person keeps getting dropped or demoted, whether a peer in the same role would be treated the same way, and whether the changes line up with lost meetings, lost credit or reassigned work.

A recurring oversight deserves attention even when each instance has an innocent explanation, because whatever the sender intended, it may show who is not top of mind when the work is organized. Someone missing when a thread starts can also miss some of the decisions, assignments and credit it carries, so repeated omissions can harden into a role nobody formally changed. The ostracism research suggests where sustained exclusion can lead. In one large organization where O’Reilly and Robinson’s team tracked departures, ostracism predicted actual turnover three years later and harassment did not, though again the study did not measure exclusion on email specifically. When the answer is unclear, a direct question usually costs less than a theory: “I noticed I’m off the thread; should I still be tracking this?”

When the address line becomes evidence

Patterns in who is included and who is left out also matter to anyone who later reconstructs what happened. For information governance and eDiscovery teams, email patterns are evidence as well as etiquette, and so is the larger record of who emails whom. In a 2007 paper for an Association for Computing Machinery data-mining workshop, Ryan Rowe, Salvatore Stolfo and two Columbia University colleagues described an algorithm that inferred social hierarchy from patterns of communication between accounts in the Enron email archive from how much people emailed, how quickly they replied and which groups they corresponded with. They reported results they called promising when checked against the company’s organization chart and court proceedings, with the closest match at the top of the hierarchy. The study did not analyze To, Cc or Bcc placement.

The standard’s own mechanics matter too. Under the first Bcc method RFC 5322 describes, the Bcc line is removed from every copy recipients receive, and under the second, only the blind recipients’ copies carry it. Either way, the To and Cc recipients’ copies hold no record of the hidden reader, so a collection limited to their mailboxes can miss that reader entirely.

Address-line discipline belongs to leaders

For founders, managing partners and executives, the address line works like an organization chart drafted fresh every day, and a few habits make it say what they mean. Put the people who own the next action in To, and put observers in Cc with a sentence explaining why they are there. Announce removals, as in “moving Jim to Bcc,” so that Jim, who still receives that one message, knows his exit from the thread was deliberate and benign. Keep blind copies out of disagreements, where a hidden reader revealed by one careless Reply All turns a dispute into a question of trust.

The same habits apply to clients and partners. Copying a counterpart’s boss may similarly raise the temperature of a thread, though the trust research studied co-workers. Cambridge Judge also said collaboration software such as Office 365 or Slack “could also carry trust issues related to the study’s findings,” so @mentions and channel membership deserve the same care.

Stated norms matter as much as individual habits, which is the point of De Cremer’s advice. A shared rule on when a supervisor belongs on a thread removes the guesswork that lets routine copying feel like control. Communications leaders, who already decide who speaks for a company in public, are well placed to write the rule for who is addressed, copied and left off inside it.

RFC 5322 says the only difference between the three fields is how each is used. Inside an organization, that use signals who owns the work, who is watching and who drifts to the edge of the conversation until no one remembers to bring them back. Which message is your address line sending to the people you lead?

News Sources

• RFC 5322: Internet Message Format (RFC Editor, Internet Engineering Task Force)
• Transparency and Control in Email Communication: The More the Supervisor is Put in cc the Less Trust is Felt (Journal of Business Ethics, Springer Nature)
• Email Copies in Workplace Interaction (Journal of Computer-Mediated Communication via Wiley Online Library)
• Is Negative Attention Better Than No Attention? The Comparative Effects of Ostracism and Harassment at Work (Organization Science via IDEAS/RePEc)
• Egocentrism over e-mail: Can we communicate as well as we think? (Journal of Personality and Social Psychology via APA PsycNet)
• Automated social hierarchy detection through email network analysis (Joint 9th WebKDD and 1st SNA-KDD Workshop 2007 via Stevens Institute of Technology)
• Cc’ing the boss can ‘backfire’ (Cambridge Judge Business School)
• Ostracism more damaging than bullying in the workplace (University of British Columbia via EurekAlert!)
• A Drawback of Email? Miscommunication! (Whitman School of Management at Syracuse University via Newswise)
• Breaking down the infinite workday (Microsoft WorkLab)
• E-mails and egos (American Psychological Association, Monitor on Psychology)
• Workplace Ostracism More Distressing Than Harassment (Association for Psychological Science)

Assisted by GAI and LLM Technologies

Additional reading

• Estonia’s AI agent register would link a code to a person, and state watchdogs ask what that proves
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis
• Latitude59’s four-country push puts startup deals in front of four data-protection laws
• Tallinn Digital Summit 2026 puts the agentic state to the test

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.