Email Verification Flow for Resending Verification Email to Rightful Email Owner

Question

Scenario:

User A "Sheri" has email sherri@example.com, and signs up for a forum. She makes a typo and enters sheri@example.com during sign-up. She never gets the activation email, and realizes the error after clicking sign-up e.g. when the page says "Activation email has been sent to sheri@example.com"

She then signs up again entering her correct email address, and activates that user account.

This leaves an un-verified account still in the DB for email address sheri@example.com (we don't purge rows, they remain indefinitely, in an un-verified state).

Then, user B comes along sometime down the road, and her email is sheri@example.com. She tries to register, and when she types her email in the email field, she receives automatic feedback to the effect that a row exists with her email address, and a verification email is automatically dispatched.

My questions:

1. What is the best way to message this scenario to user B when she types in the email during a new account sign-up?
2. What is the best way to proceed (workflow for user B) to activate the account and set her own username (since the one that user A chose would be different from what user B wants)

Also note that this scenario must also "fit" for when it is just one user, e.g. a user creates an account and for whatever reason, doesn't activate it. some time later, comes back and tries to create an account with the same email address.

Answer 1

There are a few things here that would need to be optimized and improved IMO.

1. If verification email has gone out and not confirmed - remove that account or mark it that someone else can claim that account. The worst thing you can do is to lock an email address and don't allow an owner of that email to register. Some websites force the user to reset a password in this scenario and both are an "OK" solution, however I think removing unverified account is a better solution from both UX and data stand point.

2. If you go the suggested route, then the answer to your main question is: Take User B through the same registration process you took User A. User B may knot know User A and giving them a perception that someone has previously registered on their website with their email address is alarming and/or confusing.

3. If you go the password reset route, then you need to make sure you offer a soft landing experience to support registration for first time users if the account was NOT verified and a password is being reset. In other words, try to make this experience match you regular registration experience with some subtle changes (instead of provide your info ask the user to verify the info you've collected already if any)

Logins

It's a better UX if you DONT ask the user to specify a unique username. Usually those are tough to remember and if the one you want is already taken, you would have to make up a new one which you wont remember.

Use the information your customer is most likely going to remember (eg. email address)

If you are using email address as a login, enforce uniqueness of it in your system or simply rely on the combination of fields that will uniquely identify a user (eg. email address and website they are login into)

Answer 2

Fix the system problem first

When someone submits an address, a date should be attached to that entry. If the address is not validated within a given amount of time, the entry should be set free.

Answer 3

If an account has already been created using a pre-existing email (either by error or other situation entirely) you would prompt the user like you've outlined. "There is an account with this email already setup."

Then offer a suggestion on next steps to continue the process:

1. Verify the email address you entered is correct.
2. If [email] is yours but you have not activated your account, click here.
3. If you've forgotten your password, click here.

If you want to be honest with the user those are your best options (versus disguising option 2 and suggesting they already signed up themselves and forgot).