In my project I am planning to have email as login.

I am planning to send a confirmation email after signup. Activation link will be valid for 7 days.

If someone uses my email id and creates an account. So I will be getting an email. I want to disable the account because i never wanted to create an account.

So in the email, should i have to send a link to disable the account. Or what is the standard way to handle such situations.

  • 2
    This is more of a security issue than a UX one. If someone uses your email to register then generally a confirmation prompt would be sent to that email address. If the owner of the email address doesn't confirm the link then the account isn't created.
    – JonW
    Mar 19, 2018 at 17:17
  • Assume coincedentally during that same time i want to create an account using my email address, it will not allow because someone has already filled in my email address. So how to manage such situations
    – Santhosh
    Mar 19, 2018 at 17:25
  • That's up to you. If someone doesn't confirm their email address then just don't write that email address record into your database. As I say, this isn't really a UX question, it's a security one.
    – JonW
    Mar 19, 2018 at 17:29

3 Answers 3


One would think that email validation links are a pretty strong deterrent against using someone else's account. Once the email account owner receives the notification, s/he can change the account's password, and gains control. I don't think a "disable this account" link is necessary, and you might risk users accidentally clicking on it out of confusion and disabling their accounts.


Unverified accounts usually have a limited functionality, which encourage users to verify their email and discourage bad-intentioned users to enter random emails.

If people entering random emails is really harmful to the project, I would look into the possibility of a link for this case. Something like:

"You just registered to our product, click this link to verify your email. If you don't know what this message is about, do X and we'll disable the account"

Note that this is just an example, and disabling the account might be too extreme.

A sever example is Coinbase, which deletes non-verified accounts after a non-specified time.

Coinbase email


There are multiple ways to address this situation.

I would like to explain and suggest you a simple and intuitive one here.

  • When the user tried to open an account with you by singing up.
  • During which he is asked to provide an email address.
  • Your problem is what if the user provides someone else's email ID!!

  • So to overcome this problem, what you can do is to send an activation mail immediately to the email ID provided during sign up. Stating - the account opening process would be complete and the account will be created once it is activated through the link sent on the email. So once the user selects the activation link then only the account would be created.

Between, until the account activation is complete, don't create an entry for the account in your database. This could avoid you the problem where in the genuine email ID holder tries to create an account with you!

When you send an activation link to the registered email, you could send an another link somewhere in the bottom to report if the email was recieved inadvertently. So that you can take action on the sign up in the pending state. Say, you can bar the malicious sign up process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.