1

I tried to login at a big-brand site with email and password and got the answer "Wrong email or password". I tried to reset my password by entering the same email address.

Please check your email

We emailed instructions to
<redacted>
Didn't receive it? Check your spam folder or send the email again.

But got no instructions email. So, after a dozen tries, I checked whether invalid mail addresses would yield the same reply, and got the following:

Please check your email

We emailed instructions to
bork@bork.bork
Didn't receive it? Check your spam folder or send the email again.

Still having issues? Contact customer support.

Now I ask myself: Is it good UX to lie the customer in the face?

4

Three points you should consider

1) They didn't lied to the customer. Customer gave an email address to recover a password with which he has never registered. So, customer lied first (this is why email confirmation field is present most of the times during registration).

2) It is not secure to tell the user that bork@bork.bork doesn't exist, since then an attacker can run a bot to find which emails exists leading to leakage of email addresses.

3) There is also a technical limitation in telling whether an email-id exists or not. Most of the times emailing solutions simply communicate that mail has been sent and later on share delivery failure notifications.

So, there is a security reason and technical reason for showing the message that is displayed. Also, this doesn't lead to bad UX either.

Edit 1:

What would be a better message?

An email has been sent if this email id has registered.

or

An email has been sent to your registered email id.

  • The argument could be made that the TLD makes it obvious that it's an invalid email address, but I would caution against that, as you don't know when and if .bork will become available. – Nathanael Feb 3 '16 at 11:54
  • They did tell me to enter my email address, which I did before trying bork - and I didn't get a mail (because I had signed up with a different address). So I still think they lied to me, because their statement is wrong, and deliberately so. They could have told me: "We have sent an email if that email address is registered", in which case I would get the idea earlier that I possibly used another email address for signup. – Alexander Feb 3 '16 at 13:37
  • @Alexander We have sent an email if that email address is registered yes this would better since you are being more direct without creating security issues. Even better would be 'Email has been sent to your registered address'. – gurvinder372 Feb 3 '16 at 17:39
1

First thing I found - bork@bork.bork doesn't exist - but bork@bork.com does actually exist so it's not so silly an email.

This got a bit long, so tl;dr

  • Pinterest - liars
  • Google, Facebook, Trello (nicely) - all tell you if the account exists
  • Slack - agree with you and gurvinder372's answer

Personally I'm a fan of Slack's UX in general, you could also combine it with some of the language from Trello.

One other thing I like but don't see done is just to do a DNS lookup of the email domain as that that might pick up spelling mistakes, but doesn't rely on any regex and doesn't release any private information.

The long bit...

Lying to customers is a bad thing. Please don't be offended, but I genuinely find it quite interesting how offended you are by it, rather than just assuming it was a developer who didn't think of catching the case of someone trying invalid email addresses.

I have a guess that they might be just re-printing the email you typed in back at you in an attempt to show you if you mistyped something.

Anyway, it's interesting to see what companies do, because forgetting passwords and emails is really frustrating and so UX folks should be very careful.

Facebook make you search for your account, I guess they figure that so many people have Facebook accounts that there's not much to be made by someone knowing you have a facebook account:

enter image description here

I thought Google was doing some kind of basic domain checking as it rejected bork@bork.bork but accepted bork@bork.com.

enter image description here

However further checking showed that banana@bork.com isn't recognised by google. So it actually looks like bork@bork.com definitely is a real email address and they now think that someone is trying to hack into their account.

enter image description here

Pinterest are clearly just a bunch of liars (perhaps this was the site you hit):

enter image description here

Trello, follow along Facebook and Google lines of just telling you whether the account exists or not. However they're more friendly about their message, which is always a good thing:

enter image description here

Slack first assumed that bork.slack.com does exist - it seems that they'll accept anything I tried bananananananana.slack.com and it let me reset my password for that too.

We finally get to someone doing what you and gurvinder372's answer suggest. The wording is quite nice too:

If we found an account associated with that email address, you will find an email from us in your inbox shortly.

Unsure which email you used to create your Slack account? Please contact feedback@slack.com.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.