What is the best practice for resetting an invalid email address as username

Question

Setup:

1. Site is for utility customers to view usage and pay bills etc.
2. Usernames are email addresses
3. Passwords can be reset by providing an email address to which a password reset email is sent
4. The user has both forgotten their password and no longer has access to the email address they used to register

I was considering allowing the user to change their email address, but what information should I ask for to validate the user? I've seen negative feedback regarding security question usabilty. Would it be better to ask about account information, e.g. past payments or something?

Answer 1

Since it's a utility website, you've got lots of customers data to validate. I purpose:

• You may ask for backup email ids
• In case user forgot his email id and password, let him login through any of the utitility bill number and validate with last amount he paid.

Answer 2

You need a multi-level verification process. Since your platform works with bills and other pieces of confidential information there is a lot of data that you can use for this purpose (a combination of these pieces of data is required to prevent abuse) - real name, bank account number, serial number of last purchased utility, phone number, zip code, complete address etc.

Some of this information can be requested from the user upon registration like real name, zip code, phone number etc. Many web sites allow the user to give an answer to a question from a set of questions (trivial ones: what was your first pet's name?, where did you go to school? etc.). Multiple such questions will reduce the risk of someone guessing just the answer to a single question and then gaining full access over the account of the user.

No matter what you choose you have to cover two steps:

1. Retrieve user's email address - this is where most of the input goes (answering secret questions etc.).
2. Reset user's password - send the new password to the email address that user has given

Some times it happens that the email account is no longer valid (account has been closed either by the user himself or by the email provider for some reason). In this case you need to make sure that the user can change it! This is where the confidential information you have about the user also can come in handy.

Last but not least you can always think about sending a sealed letter with a code inside (some banks even make PIN numbers send via post "self-destruct" by using various chemicals that make the ink disappear after a very short amount of time (often just a few minutes) when it gets in touch with air or liquid). Naturally this will cost some small sum which you probably will have to bill the user for.

Answer 3

Give them the option of choosing to provide two pieces of information that would validate that they own the account. As you are a utility company, you have the benefit of already knowing a lot about the user's personal information. It may make sense to have to two pieces of information be things that cannot be found through public record, which is why maybe a combination of account number OR address AND last payment amount might make more sense for added security. Once they gain access, make sure they enter a new valid email address and password. And clear any saved payment methods!

Some ideas for information that could validate their account: ask for their billing address and/or zip code, service address and/or zipcode, account number (maybe show an example utility bill pointing out where to find the account number), their phone number, their last payment amount (they could find it through their online banking), first and last name on account (disregard capitalization when validating).

Make sure that you have data on all users for whatever options you choose. For example, if some users in the database do not have a phone number, then phone number as a validation method will not work.

As a last resort, provide information on how they may have to email or call customer service, and make sure customer service knows how to restore their account by updating the email address.

Answer 4

As you are utility company, you probably have some device (like Wattmeter, gas meter, water meter). That device has serial number which is great unique identifier for confirmation of identity as for using it as username. Usually it is within home, so it's not public and, if used as username, it can't be lost.