Prompting customer login before making changes to their account

Question

In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the same account so they can all use the service.

If a customer tries to register a new account for an object and they already have an account, I would like to give them the option to add it to their existing account in order to reduce the number of duplicate accounts.

Let's say after the first step of the registration process, the system determines that this object is owned by someone who already has an account.

My client is pushing for a confirmation screen that informs the customer of an existing account and gives them the option to add it to that account without authentication. This essentially allows anyone with enough information to be able to add an object to a persons account without authentication.

My preference would be that user should verify that it's their account (by logging in) before adding objects to an account.

Are there standards or best practices around account management and privacy that I can share with my client?

Answer 1

I think you should have authentication because you aren't losing anything with it there, but can lose a lot without it.

UX wise, that's a good idea because it will allow users to feel safer with that functionality in place, which ultimately increases your security which also enables user trust.

To implement it, it could be as simple as:

^{download bmml source – Wireframes created with Balsamiq Mockups}

Obviously visual treatment could vary, and depending on what your developers (or your security team) say if this is secure enough to implement.