I have been thinking about whether to implement email verification feature in my app for a while. I want to let users login even if they do not have a verified email. If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem. Although I don't see a point in asking to verify email accounts, I am feel like I am missing something important here. What is point of email verification in this scenario?
Essentially, what it comes down to... is are you dealing with USERS or PEOPLE on your site.
Most companies prefer to have a relationship with a person. Exceptions would be reddit and other sites which are designed with anonymity in mind and are almost purely online communities.
- A verified email is a verified person behind the email. Prevents some simple bots
- A verified email can reduce a person's frustration if the email was typed in wrong. If a user joined some music service, made a bunch of playlists and then logged out and forgot the password... it would be helpful if they could reset their password properly.
- A verified email is higher value for marketing purposes. You know that the email is not fake and a dead end. You can analyze the users's habits and target them specifically based on their browsing habits.
- A verified email allows you to contact a person about security breaches or other important site issues, site announcements.
- A verified email prevents abuse. I constantly receive spam and information from sites I never signed up for because there are several people with my name who either sign up for services and mistype their email address or they're signing up for some random hook-up site that doesn't require a verification (for obvious reasons). If these sites verified emails, I would get an email asking for verification and promptly ignore it.
Alan George covered the main reasons you should verify emails but I just wanted to touch on this point in your question.
If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem.
That is a HUGE problem. Under no circumstance should you be able to hijack another persons account, even if it's your email. The other person may not even have maliciously/intentionally used your email it could've been a type. If that person has any personal information, post history, contacts, and god forbid financial information its a serious privacy and potentially legal concern to be able to take over that account from an unverified email.
If this account has any paid subscriptions or in-app purchases then that is going to be one very upset user if all of a sudden they try to log in and it's gone. Even if the account has nothing of monetary value it could have a ton of time invested, like if the app is a game and they spent thier time progressing just to lose the account. I know if someone took over my account here after years of building my reputation I'd be furious.
There are a number of reasons.
- Requiring users to verify their email assists in preventing spam registration. It is an extra step, and also requires access to many email accounts.
I designed a personal website many years ago and didn't require email registration, because I did not expect very many people to use it. I left it dormant for a while, and came back to find many of my posts riddled with spam comment ads for the darker aspects of the internet.
- If a user forgets their username or password, a verified email is often the easiest method for recovery.
If you make a typo in your email address when registering or don't in fact have access to it, you may not be able to recover your website account.
- Having a known accessible email to contact users at is desirable for companies.
Naturally, from a user perspective marketing material is undesirable. From a company perspective, however, it is very desirable to pass along information to verified user emails.
Important account notifications require a verified email, such as suspicious activity or priority messages. Imagine signing up for online banking and fraud alerts are being sent to a non-existent email.
There are some cases where email verification may not be immediately (or at all) necessary.
- Allowing limited features until email is verified
- One-time registration, such as completing a transaction
- Sign-up forms for events or accounts where other contact information is provided (such as a phone number)
- Allow registration with other accounts that have verified email addresses (Facebook, Google, LinkedIn)
In the first place you are trying to secure the form input to your site. Secondly, everybody wants to talk to people and avoid spam emails, incorrect form entries and other key aspects that could potentially harm the account creations or even disrupt the ordering process.
First (5-10 years ago) validation processes targeted mostly domain validation, entry validation firstname.lastname@example.org and other key aspects like ip validation to exclude multiple subscriptions.
From a programmers point of view these validations (and others about the security part) are enough. But, and there is a big but, other departments like marketing, sales and so on that need other types of email validation.
I usually recommend integration with different API's in order to exclude and separate possible spam traps, emails known to be abusive with spam marking and so on, validation procedures that are good mainly for marketing departments.