In a project I'm working on, there's a service website where customers can register objects they own in order to use the service. If a customer owns many of these objects, all can be registered on the same account so they can all use the service.
If a customer tries to register a new account for an object and they already have an account, I would like to give them the option to add it to their existing account in order to reduce the number of duplicate accounts.
Let's say after the first step of the registration process, the system determines that this object is owned by someone who already has an account.
My client is pushing for a confirmation screen that informs the customer of an existing account and gives them the option to add it to that account without authentication. This essentially allows anyone with enough information to be able to add an object to a persons account without authentication.
My preference would be that user should verify that it's their account (by logging in) before adding objects to an account.
Are there standards or best practices around account management and privacy that I can share with my client?