I have a site that allows logging in through:

  1. Email (must be verified and unique)
  2. Facebook
  3. Twitter
  4. LinkedIn.

Once you have created an account through one of those 4 methods, I provide the ability to link additional accounts. However, if you have signed up through email, then attempt to login through facebook, I check to see if the email returned from facebook already exists in the system. If the email is already associated to a verified account, I simply link the account and log them in.

I think of this as a convenient method to login and have tried to think of security, privacy and inconvenience issues that could present themselves, but haven't been able to think of any. I could perhaps see people thinking of their facebook account as distinct and not as an email address then maybe being confused as to why their account got associated to their existing account.

I have read this thread, but it seems to be a slightly different question since they are dealing with unique usernames, not emails. Are there security issues I might not be thinking of? I have looked at other sites as an example and it seems to be varied as to what they implement, though there are quite a few sites that will create an SEPERATE account for you if login with social, ie: I had an existing account created using x, then signed up with facebook and it's treated as a separate account.

Is there something I might not be thinking of from a UX standpoint that would necessitate me not linking the accounts automatically?


  • A User signs up with email/password
    • A User verifies email. Can now login.
    • A User can link social accounts on their profile.
  • A User can sign up with social.
    • A User can sign in immediately, there is no verification.
    • A user can link other accounts & set a password on their profile.
  • If a user already has an existing account, and attempt to login through a social method
    • If there is a matching verified email address, the account is linked and the user is signed in. There is an informational message letting the user know.
    • If there is no matching email address, a new unique account is created.

6 Answers 6


The social accounts anyways confirms if the user wants to log in to the service with the current account or not, so I see no issue or security concern with not linking the social accounts if the email address is same as the one the user signed up with.

It is always a great practise to link the account if the emails match and that is what the user mostly wants. If you think that the user wants to create a separate account then give him an option of choosing what do do if a similar account is found instead of deciding on your own.

Users like to feel in control, specially with their account(the reason you call it My account is because they should feel in control) so let it be the user's prerogative and not the developer's.


I wouldn't say that there are any security concerns because if access to the e-mail is required in all cases, you know that the user should be owner of both accounts.

However, the user may not want to link the accounts for whatever reason. A lot of times this may just be paranoia of granting additional permissions to your site that they'd rather you not have. But even if you just use the e-mail portion of the account and no other access is granted, you should still offer the user some options if they attempt to log in with a new account under the same e-mail address:

  • Log in with their existing account
  • [if your system can handle it] Log in with their new account but don't link them
  • Link the accounts and log in

That way the user isn't forced to have their information stored in an extra database somewhere on the internet if they just forgot which info they used to log in the first time.

  • At what point and how (not technically, from a UX standpoint) should the accounts be linked? Commented Dec 16, 2016 at 18:23
  • @Taylor Ackley Only after the accountholder agrees in detail, and it should be linked only to the degree permitted. So you potentially need a big page for that, with a prominent notice at the top that at that moment there is no linkage at all, a big "thanks but no" button at the bottom, and a complete set of detailed choices (with real explanations, not the popular "set x to 0" type found in so many code comments) in the middle.
    – MMacD
    Commented Dec 19, 2016 at 20:26
  • @TaylorAckley If the user specifically selects the "link accounts" option on the login screen, then the accounts should be linked immediately before the user is logged in. Commented Dec 20, 2016 at 21:24

Actually it follows the same logic as the other post you linked. The reasoning on the UX side is simple: we all use so many services and apps that we don't remember, if we get logged out after weeks (or months) of using (or nonuse), how we registered in the first place.

Secondarily, not all users are comfortable with every type of social login. Facebook's login was compromised early this year (and has since been amended) where some access was automatically provided to the application/site without user consent. My own research over the past few years is that while a large percentage of users will happily use Facebook to login, there is significant distrust with it too. Twitter is more trusted but used much less. Google is more trusted, but their login service required a full email and password to set up, which is more cumbersome than the one-button register Facebook and Twitter offer. And frankly unless it's an enterprise or business-oriented app/site, LinkedIn just seems superfluous.

That means options are good, but it can also lead to confusion. So unless you store a cookie/data of what the user used to register, they may make a mistake. Then you're left with user orphans, where someone might accidentally have two or more accounts. That's a terrible experience.

I've found two simple solutions to this problem, in order of best UX:

  1. Only offer 1 service and/or email: this solves the confusion problem for 99.9% of users because if you don't trust Facebook today for login, you won't trust them in a month or two. Or, more importantly, you'll remember that you didn't trust them. So upon returning to the login/register screen, users will know which path to follow.
  2. Use a phone number: This one's awesome for mobile, though with web it's more challenging because it requires a deeper level of trust. I've built three apps now that have used phone number registration and it rarely fails because users are concerned that their number is now compromised. It's a safe practice. That's not necessarily true on web however, meaning the experience of typing in your phone number on a desktop-based site (or even a mobile site, oddly) has a level of distrust beyond that of mobile apps. There is one way to mitigate that distrust: make that number entry field a numpad keyboard. It's stupid but it makes sense. Users will trust it more if it's easier to type in the number, especially if simple things like formatting are handled automatically.

The only alternative, as mentioned earlier, is to record how the user registered (but not their registration info), which has a number of problems associated to it, so it's not recommended.

  • 1
    There is a lot good information in this answer, but in my opinion does not address the spirit of my question which has to do with linking accounts automatically. Commented Dec 16, 2016 at 18:21
  • 1
    Sure it does. Trying to link them directly is already after thar bad UX decision. If you're going to make it, then every time a user logs in incorrectly they'll be taken to a registration screen (since that account they attempted to log into doesn't exist) and will have to log in again somehow. The system will need a place that offers the option that's akin to "oops, you were already registered? Click here to connect accounts)". That isn't conducive to creating a good experience at any step. My answer is circumventing these problem and where it leads altogether.
    – Jamezrp
    Commented Dec 16, 2016 at 18:26
  • With respect, your number 1 solution to the problem – "Only offer 1 service and/or email" – is not a solution. You can't only offer one social login option with no email/password alternative because no single social site has universal acceptance. And as soon as you offer email/password as an alternative, you encounter the OPs problem: to link or not to link.
    – Tamlyn
    Commented May 30, 2022 at 12:54

I would argue from a user standpoint there ARE security concerns. Remember you have to design for all levels of computer skill. People are concerned with security. How will Grandma Jenkins know that if she signs on with her Facebook account that her FB login/pw will be confidential/secure?

What is your site or service? Does it look legit or bogus from an outsider/new user?

If I'm on a new site and given the option to use my e-mail or social login:

E-mail = If my first impressions are that the site or service is legit or useful I will provide my real e-mail address - if not I'm signing up with my defacto bogus [email protected] throwaway e-mail.

Facebook = Tinder is an example when you don't have any other option so yes I'll login with FB - but it's an app that has already been vetted. It makes sense too as FB is a social site as well as Tinder. Why doesn't Tinder have an option to sign on with a JP Morgan Chase, Bank of America, or Wells Fargo login? ...because it doesn't make sense.

Linkedin = Professional use only, unless your site is business/career related good luck getting people to use their Linkedin credentials. Again does it make sense to have that as an option in terms of your site's content/service/demographics?

From a user standpoint it's definitely a convenient and nice feature to have the OPTION to link accounts after the site is deemed useful.

So it depends on the focus of your site and user personas. Provide more details on your site and related user personas if you want to discuss further.


There is always a security concern if you handle payments on your website, if the user never used his facebook account but has the same email linked to the facebook account. And if the hacker somehow gained access to the facebook account and the user never knew about it because he never uses his facebook account. So now the hacker can log into your website and make purchases on the users behalf without the users consent. So unless the user manually consents to pre approving facebook to their list of social logins, you should not automatically link them together.


There is one security issue that can occur if you are not checking if the email address of the 3rd party social network is verified by that 3rd party. So when linking a user's social account to an existing account automatically, you should ensure that 3rd party network does not allow unverified emails to be used for OAuth authentication or has a way to tell if an email is verified or not. This is usually the case for most major providers, but you have to keep that in mind. Otherwise, there is going to be a pretty bad security issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.