What is the best policy for allowing clients to change email?

Question

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also allows users to change their email address after verification (with a re-type email field, as well).

What are the pros and cons of having the user re-verify their email. Is this even needed?

EDIT:

Summary of answers and comments below:

• "Over-verification" annoys people, so don't use it unless critical
• Consider a "re-type email" field to prevent typos, but users can still copy/paste, rendering it moot.
• Beware of overwriting known good data with potentially good data
• Send email to old for notification; to new for verification
• Don't assume that the user still has access to the old email
• Identify impact of incorrect email if account is compromised

Answer 1

if you are going to allow your users to change an email address you need to verify the new email address and send a notification to the old email address. The verification of the new email is more optional, but since you verified the original address not validating the new is an inconsistency, that can turn known good information into potentially useless information. The email sent to the old address is for security reasons in case the account was compromised, so the user can be notified and take action to recover the account if necessary.

You could also require the user to click verification links sent to both emails in the case of an email change and lock the account until both are verified or your customer service is contacted. Doing something like this really hurts user friendliness and should only be used if your application is something that if compromised can cause significant monetary losses or physical danger.

Answer 2

Verifying an e-mail address by making a user enter it twice is a stupid idea (as a result, it is also a much copied idea). The user can verify what they entered the first time by reading. Requiring a password to be entered twice does make sense, since the user can't read what they typed (a the typical password edit control masks the actual text).

Answer 3

Why not provide whatever verification of the email there in the form?

Ultimately, the question you need to answer is "why are we verifying an email address" before you can answer whether or not re-verfication is required.

If the idea is to really enforce an opt-in mentality, then a re-verification may be appropriate.

If the idea is to make sure they didn't mistype something, providing a 2nd field to re-enter the new email address against for verification may be sufficient.

And then you should consider how the user will view a re-verification. Without knowing the domain of your site, I would be annoyed at having to do so. But I'll acknowledge there could be a domain or a use case to where I as the user would want you to re-verify my email address.