Currently on my site's signup page there are two email fields and one password field. The logic is that if users don't enter their password correctly they can always recover it later with their email. However I notice that some users are managing to enter a wrong email twice (it bounces), and in this case, I'm not sure how to help them recover their account?


What I'm trying to do here is recover an account when a user doesn't know the email they used to sign up (because they misspelled it), in which case there's no way we can send them an email, and I can't see a way for them to identify...

  • Should this be log in / sign in rather than signup? It would be good to clarify to make the question clearer.
    – Michael Lai
    Commented Mar 19, 2015 at 22:19
  • I'm talking about sign up indeed!
    – ben
    Commented Mar 20, 2015 at 1:14
  • Are you absolutely sure that users are "entering the wrong email twice"? 1. Many users sign up with fake email addresses out of curiosity to see how a site works; 2. Site hackers will use fake email addresses to brute-force a login/password-recovery form; etc.
    – tohster
    Commented Mar 20, 2015 at 2:03
  • I think so; it's emails that look very close to being correct and sometimes they've clearly forgotten a letter or mixed two. My guess is that they copy/pasted from the first field into the second.
    – ben
    Commented Mar 20, 2015 at 16:01

5 Answers 5


You can't fix stupid, but you can fix careless

This is a good example of UX tradeoffs. You could fix the recovery problem by asking for a secret question, mobile phone number or additional identifying information.

But before you do that, are you sure you're solving the right problem?

  • Consider the cost. Asking for more information creates more UX friction for your app. Let's say 5% of your users mistype their emails. If you ask for more information at sign-up, you are creating additional friction for 95% of your users just to handle the 5% of careless typers.
  • Have you solved the upstream problem? Addressing account recovery is a downstream problem caused by upstream carelessness. Users entering account recovery are already frustrated, so if you can avoid a recovery situation to begin with, that is going to be a MUCH better experience for users.

Here's an approach to improving the upstream problem:


Get users to enter their email address more accurately by:

  • Prompting them for a confirmation.
  • Disabling cut and paste on the confirmation.
  • Explaining why accuracy is important.

This may help solve the upstream problem for careless typers. There will always be a tiny minority of users who will still mistype their names, but you cannot let the "tail wag the dog" by creating hurdles for the 99% just to serve the 1%. At some point, you can fix careless but you can't fix stupid.


Since the e-mail is the crux of the transaction, you should definitely have users verify their email or click a link from within their email for the initial login. It might seem like a hassle for the initial login, but you will never again have the problem you mention.

But to answer your question, short of guessing the appropriate e-mail address, how are you going to contact them anyway? If they are actively using the accounts they signed up with, then you could give them an in-page alert that says their e-mail was unverifiable / unreachable and ask them to enter a new one.

  • I guess I could test the email address right after they sign up and show a message if it's invalid. The thing is that they won't be able to go back into their account later because they won't know the email address they used to sign up, and they won't be able to receive a confirmation link or anything in their email...
    – ben
    Commented Mar 20, 2015 at 1:17
  • Ideally you test it before making an account for them, but it could still be valid and still be incorrect (somebody else's address). The only real way to verify accounts for e-mail is to have them click a link from your first e-mail to them. You can use something like scrypt (en.wikipedia.org/wiki/Scrypt) to make a hash of email-address&account-name and send them a link that contains it. When they click the link you'd have your router/handler decrypt it and therefore know that the e-mail is vaild. like making verification tokens. more on the stackoverflow side of the fence though
    – sova
    Commented Mar 20, 2015 at 2:52

Some sites offer alternative means of retrieving your password like cell phone (sms) or a backup email address.

It's after the fact now, and I can't think of any good ways to deal with it at this point.


There are a couple of common strategies that are used, and depending on the information that you collect and how the website is designed, you can consider them:

  1. Secret/security question: commonly used in websites where a high level of security is required to recover or reset password information. Some people also ask the user to remember the secret/security question that they nominated as an added level of security.
  2. One-time access code: commonly used in email or social media applications, but the primary purpose is to prevent unwanted access rather than retrieving or resetting password details. If you collect a secondary contact information such as phone number or another email address then you can you this strategy.
  3. Proof-of-record/account question: commonly used in government or secure applications as part of the identity verification process, where you ask the user a question about their account that they should know about or ask them to pick out details that are relevant to their account (e.g. amount of money in the account, last transaction, contacts that they have) to establish ownership of the account.
  4. Show hint before the submit action: this is a preventative measure, but if this is something that happens a lot, then perhaps you should ask the user to check the input if they have failed it the first or second time (I would also consider changing it to a three strikes rule rather than bouncing on two failed attempts... getting it wrong twice makes them think about what to do rather than fail the third time).

You could run the email through a service to check the validity of the email address. Mailgun does this, this is what they say about it:

Programmatically catch user-entry errors in your sign-up flow with our API. Prevent typos and eliminate hard bounces.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.