This is the point at which a normal person would probably just change the email address in their online banking to a “spare” email address. Or that perhaps what they mean to say is “action required: check your email address is correct”. When you open an email from HSBC – potentially every time you open an email from them – your email client connects to those web addresses to get the necessary images. If you’re at my house, on my WiFi, and you open an email from HSBC, not only might HSBC know about it, but I might know about it too. If you need to check that an email address is valid, do that, not an unreliable proxy for it.