I have been thinking about whether to implement email verification feature in my app for a while. I want to let users login even if they do not have a verified email. If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem. Although I don't see a point in asking to verify email accounts, I am feel like I am missing something important here. What is point of email verification in this scenario?
Essentially, what it comes down to... is are you dealing with USERS or PEOPLE on your site.
Most companies prefer to have a relationship with a person. Exceptions would be reddit and other sites which are designed with anonymity in mind and are almost purely online communities.
- A verified email is a verified person behind the email. Prevents some simple bots
- A verified email can reduce a person's frustration if the email was typed in wrong. If a user joined some music service, made a bunch of playlists and then logged out and forgot the password... it would be helpful if they could reset their password properly.
- A verified email is higher value for marketing purposes. You know that the email is not fake and a dead end. You can analyze the users's habits and target them specifically based on their browsing habits.
- A verified email allows you to contact a person about security breaches or other important site issues, site announcements.
- A verified email prevents abuse. I constantly receive spam and information from sites I never signed up for because there are several people with my name who either sign up for services and mistype their email address or they're signing up for some random hook-up site that doesn't require a verification (for obvious reasons). If these sites verified emails, I would get an email asking for verification and promptly ignore it.
Alan George covered the main reasons you should verify emails but I just wanted to touch on this point in your question.
If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem.
That is a huge problem. Under no circumstance should you be able to hijack another persons account, even if it's your email. The other person may not even have maliciously/intentionally used your email it could've been a typo. If that person has any personal information, post history, contacts, and god forbid financial information it's a serious privacy and potentially legal concern to be able to take over that account from an unverified email.
If this account has any paid subscriptions or in-app purchases then that is going to be one very upset user if all of a sudden they try to log in and it's gone. Even if the account has nothing of monetary value it could have a ton of time invested, like if the app is a game and they spent their time progressing just to lose the account. I know if someone took over my account here after years of building my reputation I'd be furious.
There are a number of reasons.
- Requiring users to verify their email assists in preventing spam registration. It is an extra step, and also requires access to many email accounts.
I designed a personal website many years ago and didn't require email registration, because I did not expect very many people to use it. I left it dormant for a while, and came back to find many of my posts riddled with spam comment ads for the darker aspects of the internet.
- If a user forgets their username or password, a verified email is often the easiest method for recovery.
If you make a typo in your email address when registering or don't in fact have access to it, you may not be able to recover your website account.
- Having a known accessible email to contact users at is desirable for companies.
Naturally, from a user perspective marketing material is undesirable. From a company perspective, however, it is very desirable to pass along information to verified user emails.
Important account notifications require a verified email, such as suspicious activity or priority messages. Imagine signing up for online banking and fraud alerts are being sent to a non-existent email.
There are some cases where email verification may not be immediately (or at all) necessary.
- Allowing limited features until email is verified
- One-time registration, such as completing a transaction
- Sign-up forms for events or accounts where other contact information is provided (such as a phone number)
- Allow registration with other accounts that have verified email addresses (Facebook, Google, LinkedIn)
When I signed up for Instagram, they had not put into effect an email verification process. I remember putting in my information on the registration form and discovering that there was already an account associated with my email address. Thinking that I may have forgotten that I created one in the past, I found a reset password page and did just that. When I logged in to that existing account, I was surprised to see 50+ photos posted on it that I had never seen before, most of them selfies of one stranger's face. More than that, he had created quite a bit of following for that account with, if I remember correctly, more than a thousand followers! After curiously scrolling through the entire portfolio, I realized that by resetting the password to this account, I effectively cut him off from his page! And there was no easy way to reach out to this person so that I could transfer his page to him. There was no contact information or identification anywhere on the profile, nor hints or clues in the pictures. After waiting for about a year to hear from him (maybe by DM), I reset the account and started my Instagram page. With a click of a button, it was simultaneously a destruction of an album, and a dawn of a new one.
Hopefully this story can be used as an anecdotal evidence towards the importance of email verification, and how the lack of it can encourage user adoption in the short-term, but eventually could lead to frustration (for more than one user), as well as manually reconciliation work for the service provider.
In the first place you are trying to secure the form input to your site. Secondly, everybody wants to talk to people and avoid spam emails, incorrect form entries and other key aspects that could potentially harm the account creations or even disrupt the ordering process.
First (5-10 years ago) validation processes targeted mostly domain validation, entry validation firstname.lastname@example.org and other key aspects like ip validation to exclude multiple subscriptions.
From a programmers point of view these validations (and others about the security part) are enough. But, and there is a big but, other departments like marketing, sales and so on that need other types of email validation.
I usually recommend integration with different API's in order to exclude and separate possible spam traps, emails known to be abusive with spam marking and so on, validation procedures that are good mainly for marketing departments.
Every marketer needs to address that every day 31 billion emails bounce. Certainly, this bounces cost a lot to all the marketers or organizations.
The purpose of email validation is to verify emails and send your uniquely crafted email to the right person. Though not all the bounces are the same.
1. Soft bounce. Some of the recipient’s email address has a temporary issue that may delay the delivery of the message but does not necessarily stop it altogether.
2. Hard bounce A hard bounce occurs when the email message is deemed permanently undeliverable.
There may possibly various reasons that cause these bounces: 1. The email address syntax is wrong: (e.g. missing ‘@’ sign, or extra space) 2. The email address is incorrectly typed and there’s no such email address 3. The email address expired some time back
So rather you are sending bulk emails or a single email, the email should be delivered to the right person.
Generally, people do email marketing to generate value for their business. With emails, you can pass valuable pieces of information, business details, news, etc to your targeted audience. So validating emails will help you to contact a person without spotted into spam or abused emails.
Lastly, you can improve customer engagement and save campaign money with a cleaned list.
With the increased demand for email verification now many email service providers and marketers are turning to use free email checker tools, too.