We have a registration form like the below. I'm curious if I should be displaying different text for an email address that already exists in our database. It seems like that could be used for spam harvesting.

EDIT Please note that I need a way to tell a user attempting to register that they've already registered with that email address.


download bmml source – Wireframes created with Balsamiq Mockups

  • 1
    This concept is known as Security Through Obscurity and you are correct that it is done in this manner to prevent bots / unauthorised users from determining if the email address they have entered is a valid entry for this particular system. If you know an email is valid for a website then you've broken one of the barriers for unauthorised entry to the site.
    – JonW
    Apr 10, 2012 at 15:39
  • 2
    I doubt that dumb automated scripts would actually notice if you said an address is already registered. Checking the returned error message would take intentional effort which is pretty unlikely unless you're a big or very secure firm. Useless for spam harvesting too, as they just troll the internet for email addresses, they won't check your email database this way for that; way too inefficient.
    – Ben Brocka
    Apr 10, 2012 at 16:38
  • @BenBrocka so I should be ok with the message that I have for an existing email? Apr 10, 2012 at 16:41
  • @gms8994 yes, there was a good relevant article about this somewhere, I'll try and find it later
    – Ben Brocka
    Apr 10, 2012 at 16:47

1 Answer 1


Typically, the goal of a registration form to onboard the user with as little friction as possible. If you don't provide helpful error messages (like telling the user that their email address is already registered), then you're adding more friction to the process.

The cons of being more oblique in this case ("security through obscurity", as Jon W mentioned) far outweigh the pros. As Ben suggested, it's unlikely that most email harvesting scripts will use this method to hunt for valid email addresses. On the cons side, it introduces a significant barrier for your users -- a user can't fix an error that they don't understand.

One approach that I've seen recently is an attempt to assist users beyond simply providing an error. For instance, if I attempt to create an account on Facebook with an email address that is already registered, Facebook prompts me to recover my old account instead:

Facebook account recovery

Sidenote: if your registration and/or login system allows for infinite failures without penalty, you're doing it wrong -- instead your system should institute a block or require a CAPTCHA for some period of time after some number of failures OR if the failure rate is too fast to be from a human user. One example of this in practice is signing in to your Google account -- after a few failed login attempts, it adds a CAPTCHA requirement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.