Changing the user's email address

Question

We have a dashboard that our users log into using their email and password. We don't currently have the ability to allow them to change their own email address (login).

Sometimes, a user may contact us via email to have their emails changed which will then, of course, change their login.

What is the proper way of handling this?

1. Send the user an email to their OLD email address to notifying them of this change and asking them to confirm this change

2. Send the user an email to their NEW email address once the user has confirmed (1)

What about their passwords? Will they need to input it in (1)?

Answer 1

I believe the proper way to handle this is option 1. I would definitely recommend sending an email to old address to confirm that it is indeed the same user asking for the change.

Once the change is confirmed, the user should be prompted to create a new account/passord using the new email address (for security).

Also, consider to disable/remove the old account at some point.

Here is a reference to a similar case that may be helpful: When a user's login email has been changed, what should happen?