How to recover an account when a user entered a wrong email during signup?

Question

Currently on my site's signup page there are two email fields and one password field. The logic is that if users don't enter their password correctly they can always recover it later with their email. However I notice that some users are managing to enter a wrong email twice (it bounces), and in this case, I'm not sure how to help them recover their account?

UPDATE:

What I'm trying to do here is recover an account when a user doesn't know the email they used to sign up (because they misspelled it), in which case there's no way we can send them an email, and I can't see a way for them to identify...

Answer 1

You can't fix stupid, but you can fix careless

This is a good example of UX tradeoffs. You could fix the recovery problem by asking for a secret question, mobile phone number or additional identifying information.

But before you do that, are you sure you're solving the right problem?

• Consider the cost. Asking for more information creates more UX friction for your app. Let's say 5% of your users mistype their emails. If you ask for more information at sign-up, you are creating additional friction for 95% of your users just to handle the 5% of careless typers.
• Have you solved the upstream problem? Addressing account recovery is a downstream problem caused by upstream carelessness. Users entering account recovery are already frustrated, so if you can avoid a recovery situation to begin with, that is going to be a MUCH better experience for users.

Here's an approach to improving the upstream problem:

Get users to enter their email address more accurately by:

• Prompting them for a confirmation.
• Disabling cut and paste on the confirmation.
• Explaining why accuracy is important.

This may help solve the upstream problem for careless typers. There will always be a tiny minority of users who will still mistype their names, but you cannot let the "tail wag the dog" by creating hurdles for the 99% just to serve the 1%. At some point, you can fix careless but you can't fix stupid.

Answer 2

Since the e-mail is the crux of the transaction, you should definitely have users verify their email or click a link from within their email for the initial login. It might seem like a hassle for the initial login, but you will never again have the problem you mention.

---

But to answer your question, short of guessing the appropriate e-mail address, how are you going to contact them anyway? If they are actively using the accounts they signed up with, then you could give them an in-page alert that says their e-mail was unverifiable / unreachable and ask them to enter a new one.

Answer 3

Some sites offer alternative means of retrieving your password like cell phone (sms) or a backup email address.

It's after the fact now, and I can't think of any good ways to deal with it at this point.

Answer 4

There are a couple of common strategies that are used, and depending on the information that you collect and how the website is designed, you can consider them:

1. Secret/security question: commonly used in websites where a high level of security is required to recover or reset password information. Some people also ask the user to remember the secret/security question that they nominated as an added level of security.
2. One-time access code: commonly used in email or social media applications, but the primary purpose is to prevent unwanted access rather than retrieving or resetting password details. If you collect a secondary contact information such as phone number or another email address then you can you this strategy.
3. Proof-of-record/account question: commonly used in government or secure applications as part of the identity verification process, where you ask the user a question about their account that they should know about or ask them to pick out details that are relevant to their account (e.g. amount of money in the account, last transaction, contacts that they have) to establish ownership of the account.
4. Show hint before the submit action: this is a preventative measure, but if this is something that happens a lot, then perhaps you should ask the user to check the input if they have failed it the first or second time (I would also consider changing it to a three strikes rule rather than bouncing on two failed attempts... getting it wrong twice makes them think about what to do rather than fail the third time).

Answer 5

You could run the email through a service to check the validity of the email address. Mailgun does this, this is what they say about it:

Programmatically catch user-entry errors in your sign-up flow with our API. Prevent typos and eliminate hard bounces.

https://www.mailgun.com/email-validation