4 ms·
Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this. Whether or not you have an
by MattGaiser 6y ago
Can't you just say that a password reset email has been sent? That is what we did when I worked in banking as a way to prevent this.
Whether or not you have an account, the system says a reset email has been sent.
- dasb 6y agoBut then you confuse legitimate users that don't remember what email they signed up with.
- smichel17 6y agoI why not actually always send an email to that address? If the email isn't registered, change the message to suggest that perhaps they signed up with a different email, or they'd like to sign up instead?
- kfarr 6y agoYes this is the correct answer. I've seen some systems respond with "if there's an account registered to this email address you will receive a password reset email" whether or not the address is registered
- zwog 6y agoIn most cases you can find out whether an account with a specific email address exists by trying to sign up with it, though.
- MattGaiser 6y agoFair. We didn't have that issue because you don't sign up for bank accounts online.