We have email address verification on our accounts. Users have to verify their email addresses when they create their accounts and when they update their email addresses on existing accounts. With new accounts, users cannot finish logging into the site until their email is confirmed (this will probably change eventually so that they may log in but be unable to do certain things). In the case of existing accounts, the new email is held in a "pending" state and the system continues to use the old email address until the new one is confirmed.

We also have a restriction that there cannot be more than one account with the same email address.

My question is what happens if someone creates a new account or updates an existing account with someone else's email (but can't confirm it) and the person who owns the email address tries to create an account.

2 Answers 2


The simple answer would be to only hold the new address in a pending queue for a limited time. Something like 2 days should suffice. If someone hasn't activated their account within 2 days, it's a fair bet that they aren't going to.

If you do this, you should mention in the activation email that they have 48 hours to activate their account etc.

  • The way things have been done on a site I've worked on is to have a queue where accounts can deleted or activated manually.
    – James P.
    Sep 8, 2011 at 1:06
  • I like this solution and I think it works well for changing an email address, but the question then becomes how do you pair it with delayed email verification for new accounts. If I create an account, do some stuff on the system without activating my account, and don't activate my email for two days, does what I've done with my new account get lost? Perhaps in the case of new accounts there should be some other mechanism (perhaps manual intervention when an issue comes up).
    – Pam G
    Sep 9, 2011 at 16:16

When creating an account and confirming an email, don't you send the email address the user gives an email in which they have to click on a link in order to complete the sign up process? If so, add a line saying "if you didn't start this process, click here to remove your email address from our system" which directs the user to a script on your site that does what it says. If not, build this!

So now if someone else creates an account using my email address, I'll immediately see it happening and be able to act on it. The second situation you describe (me trying to sign up while my email address is already being used in a sign up process) won't happen because it's pre-empted by the notification.

Alternatively you can have signups auto-time-out unless the activation link is clicked, in which case users who didn't sign themselves up don't need to do anything (which may possibly be preferential else I could "spam" someone by forcing them to keep clicking links to unsubscribe themselves from a possible signup process).

This is similar to what JohnGB said in his answer, except in reverse - rather than saying you have a window with which to sign up, just give them an out if they want to take it.

  • 6
    Whlie this sounds nice, nothing in heaven is going to persuade me to click on any link in an e-mail I receive as a result of someone signing up for something using my e-mail address... No way at all. This ruse is employed way too many times by spammers and phishers. Most proper activation e-mails tell you to ignore it when it wasn't you who signed up for the service ... In my view the only correct/sensible way of dealing with this. Plus, even if you provide a "backout" you have to cater for the fact not everybody will use it, for whatever reasons they may have. Sep 8, 2011 at 6:41
  • @Marjan Agreed, the ideal solution is timeout with "ignore this email". But that's not always the easiest thing to implement, so a halfway solution is what I described above.
    – Rahul
    Sep 8, 2011 at 11:26
  • I understand, but you can't rely on it and will have to cater for people ignoring the halfway solution, so you might as well do it right from the start... Sep 8, 2011 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.