Is it necessary to verify a user's email address?

Question

It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code.

Is it really necessary to do this though? The only reason I ask for an email address is for if the user has forgotten their password. But, my thinking is, it's up to them if they want to run the risk of not being able to reset their password.

Should I verify their email address, or should I just warn them that should they enter an invalid email then they won't be able to reset their password if they ever lose it?

Answer 1

We have spent the last months battling with what to do with email confirmation/verification - prior the user had to give all their details at sign up (way too many actually!) but couldn't actually login until they had confirmed their email address by clicking a link.

We stood back and looked at why we did this - three reasons really, one being we wanted users to be able to reset their password etc but also because we wanted to assured of the identity of anyone interacting with our application and this was one small way of doing so. Additionally, we wanted to know the country, industry, employees etc for our clients for marketing reasons but this is flawed as we have literally HUNDREDS of signups for companies called some variation of TEST with 1 employee working in accounting.

The problem we had was emails sometimes don't get delivered - whether it is for technical reasons or simply delays or people entering the wrong email address/typos and this was creating work for our support team but also making a poor first impression for the prospective client.

A few weeks ago we made two major decisions - we now allow clients to signup by just giving us their email address with no requirement for confirmation.

Upon doing so they are immediately logged in (so no waiting) and, in the background, an email is sent asking them to set their password by clicking a link.

This email, in effect, works as a verification email - if they were never serious and were just tyre kicking then they will either have entered a dummy email address or they will never confirm in which case we are no worse off. Indeed by asking for them to create a password we could be better off as only those who are serious and / or like what the application does and looks like etc will actually do so.

If they are serious then they need to create a password to be able to login next time - we are working through more notification within the application to let clients know they need to create their password etc but, as of this morning, we have had ZERO support emails in the last three week raised due to non receipt of signup emails.

There has been a drop in confirmed signups which we expected but this, in itself, is pretty meaningless as previously they would have signed up, kicked the tyres and never logged in again whereas now they signup, kick the tyres and just don't create a password. We need to work through the overall impact in terms of accounts created, number of users and other success metrics etc but, overall, it looks positive.

I still believe we have a need for some sort of email and identity confirmation - the way we now approach it is slightly different to how we did before but it gives the same outcome without being a barrier to the customers initial experience and first impressions and that was what was most important to us.

UPDATE:

Just thought I would update this with some stats - we changed our signup process on 28/10/2013. Below are two charts - first one shows confirmed signups (i.e. those who have then gone on to create a password) and the second shows all signups which is more akin to prior data points where all accounts were confirmed before being able to login.

As you can see, there is a drop off in the first chart where almost half of those who signup do not confirm / create a password (this maps to our current stats which shows around that percentage who only login once) and the second chart shows that, at the top end, this has not impacted signups with the number of signups remaining fairly consistent pre and post making the change.

Answer 2

If you're fine with not having a verified communication channel with your user. Then sure.

But I can't really think of an application where I wouldn't want that. Because not having that verified email means that a forgotten password is the end of the account.

Further there's few things I'd allow that type of unverified user to do that I couldn't just do with a guest that could store its settings in a session/cookie.

There's also simple solution.

Use OpenID. You know, like stackexchange does! Offer several choices and for most users you'll have avoided the annoying email verification step.

More work for you but should (mostly) solve the problem.

Answer 3

I dont think that confirming the email address is just about having a communication channel to the user. I think that confirming emails is an absolute must, if not you have to cleanup in order to ensure that no one spoofs existing emails of other users. E.g. someone can register all emails of another user to troll him. Or if he merely mistyped his email, someone else could possibly be able to reset his password, which would I think in return cause more trouble overall than confirming the email address.

Answer 4

Verifying an email address is less trouble than all the troubles that could happen if not having one for an account. Nobody is going to join your site simply because they don't have to verify their email address.
So you should have them verify it but make it as fast and as easy as possible.

Answer 5

If you need to do email verification check, don't let that be the show-stoppable for the users to continue interacting with your site, that might just increase the drop-off rate.

Other reasons such as delay in the email sending, email going into user's spam folder, will just add more reasons for them to stop interacting with your site.

As what others have mentioned, any functionalities in the site that required some form of verification first, just alert the user about it. These could include update user profile or relating to any contests that requires personal identification.

Hope this helps.

Answer 6

I think the previous answers focus way too much on the UX and convenience aspects, either for the user or for the site owners, at the expense of the security aspects.

From a security perspective:

If you don't verify emails, you're giving to just about anyone free reign to register an account on your system with someone else's email address, unbeknownst to them.

This has several impacts:

• You won't be able to verify they really registered themselves (sure, their email could be hacked but that's generally less likely),
• You open the door for a lot of manipulation and image/brand damage.
• You open the door for a lot of fake accounts.

E.g. I register a prime minister's email account to an unsavory site, and can then do whatever I want with that account and show that around. And then media have a field day and a fun news cycle for a while.

On another side of that coin, This is also why NOT letting people know that their email wasn't found in your "recover my password" process is a good thing, or you disclose private information.

If you fail at either of these, you put your users in a possibly tricky position. If you fail at both, it's really bad.

Of course, if you don't want to require email, then you can use another form of verification. And if your authentication system is not name-based, then the image aspects may be less relevant for your use case.

That being said, I see a lot of sites that fail to do this, and it means you can just churn fake accounts like crazy and do a whole lot of bad stuff.

Magic links are a handy alternative, if they are sent to an email, as they allow you to streamline your registration process but keep that verification aspect effective.

Answer 7

I think it is an important precaution for a potentially horrendous UX. A little bother in advance to prevent a lot of potential problems in the future. However, the way to make this not bother your users too much is to remove the need for them to do it right away.

If possible, let the users sign up and engage with the system, and then the next time they're on their email, they'll see a clear subject line call-to-action. If they don't validate in a while, take an action appropriate for your specific context (notification on next login, second email, etc.).

Answer 8

I think that as the application designer, you have the responsibility to protect the users from themselves. Hence, you must provide some way for them to restore it.

The e-mail option has its downsides as you said but so are other alternative like security questions. Common approach is to include a link which automatically verifies the account w/o the user need to cut and paste.

Answer 9

Personally I think it should be a requirement that the user verifies the account before they are allowed to do ANYTHING.

I own an email address that some people would consider desirable. For whatever reason, people sign up for services using this email address that they absolutely know is not their own. I have to spend an hour every few months going through and deactivating accounts.

It's a real eye opener to see what websites do not require verification. Facebook, Twitter, Apple, Playstation, etc. I was able to log into someone else's Apple account (they used my email) using the forget password system and do the Find My Phone, and it worked, and showed me on a map where they were currently located. That is absolutely absurd. Apple wouldn't even let me close the account so it's just sitting there. I had similar problems where someone would sign up for Facebook and I would get dozens of notification emails a week. It also prevented me from using my own email address to sign up as myself, because it said it was in use. One time I even had someone who signed up for a non-mainstream social network to sell drugs.

Answer 10

Yes, you must always verify email addresses with a test message containing a challenge code or link. Why? Don't only think about yourself! Keep in mind the inconvenience that you generate for many innocent non-users of your system, namely all the actual owners of email addresses that your users mistyped!

Example: I am [email protected], which seemed like a good idea at the time. However there are now at least a dozen other people on this planet, presumably having the same name as me, who regularly accidentally think that this is their email address (e.g. forgetting about some trailing digits in [email protected]), and give my address to service providers. And then I have to deal with unsubscribing myself again, which is often very difficult and time consuming.

I wish there were a legal requirement to verify email addresses with a test challenge message before storing them. It would avoid a lot of grief for the owners of addresses commonly mistyped by people with similar names.