0

So after doing some research on account recovery/lost password best practices we decided to require a backup email account for password reset. That's easy enough for new users, but I'm unsure how to message our existing users. It's going to be required and can't be associated with their employer (it has to be a private account).

Do I pop up a modal requiring them to add a backup email the next time they login? Do I prevent them from moving around in the app until they do it? How do I phrase the message? Can anyone point to any accessible screenshots of someone who did it well?

As always, I really appreciate the advice.

Improve this question

2 Answers 2

Reset to default
2

You present a very interesting problem - how to get your existing users to essentially complete one more step in the "sign up" process

The least painful way I can think of - whenever they log in next, they should be informed about this. So that would mean that you have to wait for all users to log out at some point of time, and go through the log in process. That too, I would make it optional and not forced for the first time.

If your message is worded well, and brings across the seriousness of the requirement, I believe most users will be OK with it the first time. For all others, you keep reminding them on login. If that doesnt work, then keep reminding them after login too. If it still doesnt work, then make it mandatory one fine day for the users who refuse to accept.

Improve this answer
3
  • 1
    "For all others, you keep reminding them on login. If that doesnt work, then keep reminding them after login too. If it still doesnt work, then make it mandatory one fine day for the users who refuse to accept." This is exactly what we tell our students NOT to do. Antagonising users for something like security (which they do not always value and almost never prioritise) is a good way to harm your business.
    – Steve Dodier-Lazaro
    Commented Nov 12, 2016 at 10:09
  • While I agree with you, that this might create bad experience for users, if the reminders are for things that arent of much value to the users. But I, for one, assume that this is a real need in this use case, and if it is, then there is no reason for users NOT to value this. I believe this is similar to how gmail, keeps reminding you now and then to add a secondary email, phone number, etc for password recovery.
    – JustAnotherPM
    Commented Nov 14, 2016 at 6:14
  • 2
    The key teaching of value-sensitive design is that it is not you or I who decide what the users value. It's the users.
    – Steve Dodier-Lazaro
    Commented Nov 14, 2016 at 10:05
0

The most effective approach to inform existing users about the new requirement of adding a backup email for password reset is to be transparent, brief, and informative. Clearly explain the reason behind the change and how it benefits them, along with providing step-by-step instructions on adding a backup email account.

Additionally, you can include a link to a help article offering further guidance on adding a backup email account.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.