15

I am building a prototype to a system that has a user account system in place. Of course with any account system, the user should be able to reset their password should the need arise (e.g., forgetting their password, or just changing it whenever they'd like to).

My question is whether or not a confirmation email to the user once their password has successfully been reset is worthwhile?

The confirmation message I'm thinking of would be something along the lines of: "[insert name here], your password has successfully been reset."

Would they expect to see a confirmation email when their password is reset?

Improve this question
3
  • As long as the account system doesn't send the password is a good idea. We've all been exposed to a number of these systems, and I hate it when they send the password in the confirmation email. Also, make sure that the link that you send to change the password has an expiry date. :)
    – edgarator
    Dec 5, 2012 at 6:39
  • I think your terminology here is a bit unclear. There is a difference from a password reset to a password change. When you reset your password, you have to be able to set a new password, which more often than not happens via a link emailed to you. Then again, if you change your password, you might get an email, but it would hardly say "Your password has been reset". So - do you actually mean password changes or password resets?
    – kontur
    Dec 5, 2012 at 10:40
  • @kontur In this case I do specifically mean password change. Sorry for the confusion!
    – Adam Stankiewicz
    Dec 5, 2012 at 11:41

2 Answers 2

Reset to default
21

Many might think that the complementary email might be useless, but this is actually a security message. What if someone left their account logged in, and someone changed the password for them? The ACTUAL owner of the profile should be notified that it was changed.

It has become a standard to make sure that users are aware of what information has been updated.

Improve this answer
2
  • 1
    This answer goes to the point!
    – edgarator
    Dec 5, 2012 at 6:40
  • 2
    Tell users immediately about changes to their core information: email addresses, passwords, usernames, other contact info, etc. And if you can, provide a link that allows you to undo.
    – Steffan Donal
    Dec 5, 2012 at 9:56
2

People would generally tend to be surprised if they didn't get a confirmation email of changing password.

Not only does it serve as the early security alert option for those who may have had their account altered by others, but it also serves as a confidence booster for those who did genuinely change their password. Note that the email has to be immediate and high priority - not just deferred to some bulk email sender on a chron job every hour or at the quieter periods of the day.

But it's also very important to provide some information to the user about what to do if it wasn't them who changed the password. There's little point telling the user their password was changed and not guiding them on the next stage of the process should they need it. It's critical that the next steps can be fast-tracked with simple clear steps, using calming language, as the user will likely be in panic mode at that point.

If I didn't receive an email confirmation, then I would wonder whether it had worked. I might feel I'd have to log out and log back in again with the password to confirm it worked. This can be mitigated to some extent by on screen messages that say 'your password was successfully changed', but to receive the email to my correct email address to let me know is a great confidence booster, because it seems more confirmational than a 'yeah whatever, done that' message on the website.

The email is also a good opportunity to provide a little extra information about accessing their account if it's relevant, but never ever use a confirmation email like this as a marketing ploy.

It also serves as a gentle reminder (especially to people who have had accounts for a while) of which email address is being used. Not receiving a confirmation email might make me wonder which email address is being used, and if the email went astray. This is more the case when you don't receive emails from this service very often anyway.

In many cases where you can choose what kind of email notifications you can receive from a service, these administrative emails are still not able to be switched off. This is true for Twitter, Facebook and others - you cannot opt out of emails about your account, your security or your privacy.

Would they expect to see a confirmation email? Generally yes - and increasingly so

Should they see a confirmation email? Absolutely

Improve this answer
1
  • Unfortunately, it's the very expectation of receiving an email confirmation of account status change, that makes much spam that we receive seem not so unexpected and easy to fall victim to. Ensuring that the content of the confirmation email is sufficient to pass through most spam filters is an important consideration of this process.
    – Roger Attrill
    Dec 5, 2012 at 10:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.