I don’t have an answer for you, but hopefully the online noise from such posts helps. I do have some comments on the same topic. Let’s assume Apple sends a ve

I don’t have an answer for you, but hopefully the online noise from such posts helps. I do have some comments on the same topic. Let’s assume Apple sends a verification email, and if we assume that the incorrect receiver (the real owner of the email address) is a malicious actor who verified the account when seeing such emails are received. The malicious actor can probably gather some information about the person who signed up using this address, but in my knowledge, cannot make further changes or make any purchases since Apple forces two factor authentication (though unfortunately, with SMS as a primary option). Any sign-in on the account prompts on the already linked devices to allow the login, following which a 2FA code will be shown on those devices to enter in the new/unrecognized device. So the risk for the person using this address is kinda low, though with the situations reversed, the risks for the person owning the domain are higher (caught for crimes uncommitted, losing the domain, etc.). On the same topic, I’ve seen banks sending statements and transaction details without verifying the email address. This could be because the account owner gave the wrong email address by mistake or because the bank’s operations had issues processing a paper application and changed the address to something else (off by a letter, assuming that the address provided by the person has a typo, etc.). In such cases, getting the banks to correct this can range from tedious to impossible. I don’t think email verification by sending a verification link to the email solves all the above issues. One option, which again brings similar questions, is to figure out out-of-band verification methods. I don’t think any corporation has the interest or any regulator/lawmaker/law enforcer/judiciary has the seriousness to spend time to see how this can be made better.