From Coinapult.com:
No really, is this a safe way to send money?
Coinapult is as safe as the security of the email inbox or mobile phone of the recipient. If a cracker accessed your grandmother's email and saw the Coinapult message in there, then the cracker could go get the coins. So the answer is, it's pretty safe, just don't send stupid amounts of money.
This doesn't sound like a good idea to connect to BitInstant for this very reason. E-mail is incredibly easy to intercept - there is no security on it - anything more than pocket change is a "stupid amount of money" as referenced here. Crackers need not crack Grandma's password, they merely need to sniff on any of the networks that carry the unencrypted SMTP session to deliver the e-mail, and steal the plaintext code out of the message.
If someone were to lose $20, it's not a whole lot of money, but are they going to hear? "Sorry, someone must have stolen the code out of your e-mail... you're screwed!" Wal-Mart is already taking a hit in the press for people getting scammed buying compromised GreenDot MoneyPaks and having their funds stolen by scammers before they make it home.
Any time I have ever passed a MtGox code or a private key to somebody, I will e-mail half and text the other half on my phone.
