I’m designing e-commerce registration process, and I’m in two minds about asking user for account activation via e-mail. I consider these solutions:
User needs to activate account via e-mail or he won’t be able to create account. This is standard procedure, established pattern but it also creates a lot of friction cause user in registration process needs to switch to the e-mail client, clicks activation button in link (sometimes waiting till e-mail will come) goes to the login page and log in.
User needs to verify e-mail address in 24 hours, he has full access to account, but if he won’t verify email in 24h the account will be deleted. This solution is the worst in my opinion cause people forget to verify e-mails and after 24 hours they’re shocked their account was deleted.
If user delivers e-mail address and password he doesn’t need to do anything with account, only confirmation email is sent to him. This solution creates less friction than the first one, but I wondering if this solution makes some flaws in the security issues.