I run a reasonably sized web application and from time to time I get users who for various reasons lose access to the email address they originally registered with.

The user will typically make a request from their new email address asking us to update their account email to reflect the new address. In past cases this is often due to the user allowing a domain to expire.

We never sanction such requests but it does leave us in a slight dilemma, how can we verify the identity of the individual requesting the change? We don't request users to supply a postal address and the telephone number is optional.

Is this something others have encountered? How would you recommend dealing with such requests?

Any advice would be greatly appreciated.

  • Why can't the user login to change their email address?
    – MrWhite
    Commented Nov 16, 2015 at 10:14
  • Usually they've also forgotten their password. In the majority of these cases they haven't needed to access their account for a year or more. I'm just thinking we may need to make some more contact fields mandatory on registration.
    – QFDev
    Commented Nov 16, 2015 at 10:17

1 Answer 1


Usually they've also forgotten their password.

So, the question is really... "How can you reset a user's password when they don't have access to their email?"

In short, you're going to need a lot more information from the user and consequently will need the user to have previously entered this information into their account during signup.

  • Alternative email address.
  • Telephone number. (The user can either repeat the phone number to validate or you can contact them which is preferable.)
  • Security questions, memorable word, memorable date...

If the above information is not provided then the user needs to be made aware that they are reducing their chances of being able to regain access to their account.

You can also prompt with questions about their account:

  • When was the account created?
  • When did they last login?
  • What type of account?
  • What method of payment was used?
  • What actions did they perform on the account?

You can also check their current IP address to see if it matches one of the IPs previously logged in at. (Or an IP address that belongs to the same ISP?)

Obviously some of these later points by themselves are not very strong, but in combination they might be enough.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.