User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
In my project I am planning to have email as login.
I am planning to send a confirmation email after signup. Activation link will be valid for 7 days.
If someone uses my email id and creates an account. So I will be getting an email. I want to disable the account because i never wanted to create an account.
So in the email, should i have to send a link to disable the account. Or what is the standard way to handle such situations.
One would think that email validation links are a pretty strong deterrent against using someone else's account. Once the email account owner receives the notification, s/he can change the account's password, and gains control. I don't think a "disable this account" link is necessary, and you might risk users accidentally clicking on it out of confusion and disabling their accounts.
Unverified accounts usually have a limited functionality, which encourage users to verify their email and discourage bad-intentioned users to enter random emails.
If people entering random emails is really harmful to the project, I would look into the possibility of a link for this case. Something like:
"You just registered to our product, click this link to verify your email. If you don't know what this message is about, do X and we'll disable the account"
Note that this is just an example, and disabling the account might be too extreme.
A sever example is Coinbase, which deletes non-verified accounts after a non-specified time.
There are multiple ways to address this situation.
I would like to explain and suggest you a simple and intuitive one here.
Your problem is what if the user provides someone else's email ID!!
So to overcome this problem, what you can do is to send an activation mail immediately to the email ID provided during sign up. Stating - the account opening process would be complete and the account will be created once it is activated through the link sent on the email. So once the user selects the activation link then only the account would be created.
Between, until the account activation is complete, don't create an entry for the account in your database. This could avoid you the problem where in the genuine email ID holder tries to create an account with you!
When you send an activation link to the registered email, you could send an another link somewhere in the bottom to report if the email was recieved inadvertently. So that you can take action on the sign up in the pending state. Say, you can bar the malicious sign up process.
