17

I have been thinking about whether to implement email verification feature in my app for a while. I want to let users login even if they do not have a verified email. If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem. Although I don't see a point in asking to verify email accounts, I am feel like I am missing something important here. What is point of email verification in this scenario?

Improve this question
2
  • @ShahinMursalov Security ;)
    – Kristiyan Lukanov
    Aug 16, 2017 at 15:41
  • 1
    @KristiyanLukanov Why do you think it is more secure? Please explain your answer. If someone has chosen a fake email then that means they don't care about security.
    – user105695
    Aug 16, 2017 at 15:48

6 Answers 6

Reset to default
24

Essentially, what it comes down to... is are you dealing with USERS or PEOPLE on your site.

Most companies prefer to have a relationship with a person. Exceptions would be reddit and other sites which are designed with anonymity in mind and are almost purely online communities.

  1. A verified email is a verified person behind the email. Prevents some simple bots
  2. A verified email can reduce a person's frustration if the email was typed in wrong. If a user joined some music service, made a bunch of playlists and then logged out and forgot the password... it would be helpful if they could reset their password properly.
  3. A verified email is higher value for marketing purposes. You know that the email is not fake and a dead end. You can analyze the users's habits and target them specifically based on their browsing habits.
  4. A verified email allows you to contact a person about security breaches or other important site issues, site announcements.
  5. A verified email prevents abuse. I constantly receive spam and information from sites I never signed up for because there are several people with my name who either sign up for services and mistype their email address or they're signing up for some random hook-up site that doesn't require a verification (for obvious reasons). If these sites verified emails, I would get an email asking for verification and promptly ignore it.
Improve this answer
1
  • This was the answer I have been looking for. Especially the last point.
    – user105695
    Aug 16, 2017 at 21:20
13

Alan George covered the main reasons you should verify emails but I just wanted to touch on this point in your question.

If the real owner of that email wanted to create an account and see that the email is already used then that person can always request a password reset link, so there should not be a problem.

That is a huge problem. Under no circumstance should you be able to hijack another persons account, even if it's your email. The other person may not even have maliciously/intentionally used your email it could've been a typo. If that person has any personal information, post history, contacts, and god forbid financial information it's a serious privacy and potentially legal concern to be able to take over that account from an unverified email.

If this account has any paid subscriptions or in-app purchases then that is going to be one very upset user if all of a sudden they try to log in and it's gone. Even if the account has nothing of monetary value it could have a ton of time invested, like if the app is a game and they spent their time progressing just to lose the account. I know if someone took over my account here after years of building my reputation I'd be furious.

Improve this answer
5
  • I see your point, but I can't think of a workaround for this problem. Lets say I had a typo in my email and then the real owner of that email clicked on the reset my password button. How can the administration possibly know whether the one who clicked on the reset button is the same person who created the account or not? PS: Instagram does the same thing.
    – user105695
    Aug 16, 2017 at 17:43
  • 1
    @ShahinMursalov that's the entire point of email verification. When the account is created it is verified at that email address, when the password reset link is sent to that email address you can be sure the person receiving it is the same person that created the account. I do not have an Instagram though so I cannot vouch for how they do it.
    – DasBeasto
    Aug 16, 2017 at 17:59
  • If I had a typo, then the confirmation email would be sent to wrong email as well, so the other person can confirm the account and then reset the password.
    – user105695
    Aug 16, 2017 at 18:01
  • 2
    @ShahinMursalov If you had a typo when registering, then yes the person who owns the email could verify the account and change the password but at that point you'd only lose a blank account tied to the wrong email, no harm (don't let people use an account until they verify). If you have a typo at the point of resetting your password yes an email would be sent to the wrong person but it would be to reset their password not yours, so no security implications there.
    – DasBeasto
    Aug 16, 2017 at 18:05
  • (don't let people use an account until they verify). The problem is I intend to let them use the account even if they have not verified yet. Anyway I see what you are trying to tell and I think you are correct in that context.
    – user105695
    Aug 16, 2017 at 18:29
7

There are a number of reasons.

Security

  • Requiring users to verify their email assists in preventing spam registration. It is an extra step, and also requires access to many email accounts.

I designed a personal website many years ago and didn't require email registration, because I did not expect very many people to use it. I left it dormant for a while, and came back to find many of my posts riddled with spam comment ads for the darker aspects of the internet.

  • If a user forgets their username or password, a verified email is often the easiest method for recovery.

If you make a typo in your email address when registering or don't in fact have access to it, you may not be able to recover your website account.

Contact/Marketing

  • Having a known accessible email to contact users at is desirable for companies.

Naturally, from a user perspective marketing material is undesirable. From a company perspective, however, it is very desirable to pass along information to verified user emails.

Important account notifications require a verified email, such as suspicious activity or priority messages. Imagine signing up for online banking and fraud alerts are being sent to a non-existent email.

Alternatives

There are some cases where email verification may not be immediately (or at all) necessary.

  • Allowing limited features until email is verified
  • One-time registration, such as completing a transaction
  • Sign-up forms for events or accounts where other contact information is provided (such as a phone number)
  • Allow registration with other accounts that have verified email addresses (Facebook, Google, LinkedIn)
Improve this answer
4
  • When an email adress is required why would a person supply their own email? And if you use verification, why not something like spam.la or other throw away email accounts? Which often means that it can be read by anyone on the net, and thus lowers security.
    – Hennes
    Aug 16, 2017 at 16:42
  • Yes, temp/throwaway emails will allow users to get past email registration. The difference is between putting a fence (verification) around your neighborhood (website) or nothing at all. You will at least fend off most automated spam bots attempting to register anywhere they can.
    – Alan
    Aug 16, 2017 at 17:16
  • I am not asking for email verification to login. Users can login even if they do not have verified email accounts. So I do not see how this will prevent spam accounts.
    – user105695
    Aug 16, 2017 at 17:49
  • I don't understand your dilemma. If you have no verification like your current system, you are opening the gates to spam bots. If you have at least some form of email verification, you will at least prevent the low-level attempts, and gain the benefits I listed in my answer. If the wrong email is provided, typically a user will have to still log in before it's associated with their account.
    – Alan
    Aug 16, 2017 at 18:06
2

When I signed up for Instagram, they had not put into effect an email verification process. I remember putting in my information on the registration form and discovering that there was already an account associated with my email address. Thinking that I may have forgotten that I created one in the past, I found a reset password page and did just that. When I logged in to that existing account, I was surprised to see 50+ photos posted on it that I had never seen before, most of them selfies of one stranger's face. More than that, he had created quite a bit of following for that account with, if I remember correctly, more than a thousand followers! After curiously scrolling through the entire portfolio, I realized that by resetting the password to this account, I effectively cut him off from his page! And there was no easy way to reach out to this person so that I could transfer his page to him. There was no contact information or identification anywhere on the profile, nor hints or clues in the pictures. After waiting for about a year to hear from him (maybe by DM), I reset the account and started my Instagram page. With a click of a button, it was simultaneously a destruction of an album, and a dawn of a new one.

Hopefully this story can be used as an anecdotal evidence towards the importance of email verification, and how the lack of it can encourage user adoption in the short-term, but eventually could lead to frustration (for more than one user), as well as manually reconciliation work for the service provider.

Improve this answer
1

In the first place you are trying to secure the form input to your site. Secondly, everybody wants to talk to people and avoid spam emails, incorrect form entries and other key aspects that could potentially harm the account creations or even disrupt the ordering process.

First (5-10 years ago) validation processes targeted mostly domain validation, entry validation [email protected] and other key aspects like ip validation to exclude multiple subscriptions.

From a programmers point of view these validations (and others about the security part) are enough. But, and there is a big but, other departments like marketing, sales and so on that need other types of email validation.

I usually recommend integration with different API's in order to exclude and separate possible spam traps, emails known to be abusive with spam marking and so on, validation procedures that are good mainly for marketing departments.

Improve this answer
0

Every marketer needs to address that every day 31 billion emails bounce. Certainly, this bounces cost a lot to all the marketers or organizations.

The purpose of email validation is to verify emails and send your uniquely crafted email to the right person. Though not all the bounces are the same.

1. Soft bounce. Some of the recipient’s email address has a temporary issue that may delay the delivery of the message but does not necessarily stop it altogether.

2. Hard bounce A hard bounce occurs when the email message is deemed permanently undeliverable.

There may possibly various reasons that cause these bounces: 1. The email address syntax is wrong: (e.g. missing ‘@’ sign, or extra space) 2. The email address is incorrectly typed and there’s no such email address 3. The email address expired some time back

So rather you are sending bulk emails or a single email, the email should be delivered to the right person.

Generally, people do email marketing to generate value for their business. With emails, you can pass valuable pieces of information, business details, news, etc to your targeted audience. So validating emails will help you to contact a person without spotted into spam or abused emails.

Lastly, you can improve customer engagement and save campaign money with a cleaned list.

With the increased demand for email verification now many email service providers and marketers are turning to use free email checker tools, too.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.