3 ms·

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t requ

by jb1991 7mo ago

One thing I have never understood in this current age is how in the world so many companies, including ones that handle confidential data like banks, don’t require a user to verify their email address after it’s entered. I have an unfortunately very generic email address that’s easy to mistype, and I am almost every day receiving order receipts for expensive vacation hotels, bank transfer or wire transfer confirmations, a very long list of things that I should not be receiving simply because the companies sending those emails never had the user verify if they entered the right email address. They are legitimate emails, they are often addressed to someone with the same first name as me but a different last name, so that person simply typed the wrong email address accidentally. It’s bonkers to me that there’s any developers out there working for these companies that never thought to implement simple email verification.

Gigachad 7mo ago
Because confirming the email introduces friction. And everyone is optimising for low friction even if it risks private data leaks, which you can always blame on the user for typing their email wrong.
pprotas 7mo ago
This is intentional. Email verification is friction, so it gives users a chance to reconsider whether their purchase is really necessary. This is bad for business, because they’d prefer if you were impulsive. Also, people usually type their emails correctly, especially these days with auto-fill. So not sending confirmation emails is optimizing for the happy path.
- jb1991 7mo ago
  Not just talking about purchases. I receive transaction details with bank numbers for wire transfers around the world. It’s ridiculous. I was once even sent all of the legal proceedings for a court case by a lawyer who was sent to the wrong address.
- expedition32 7mo ago
  I just recently got a Visa debit card and I have to verify every purchase in my bank app. Absolutely 100 percent fraud and security proof. However as you it is an extra step and I imagine many retailers have done the math between fraud and friction...
plagiarist 7mo ago
I am dismayed that it is legal to create an account attached to an email without validation of that email. It should be straight-up massive fine illegal to send any email other than account confirmation until validated. Validation emails should have a "do not contact me again" that works with a single click and a massive fine if it does not.
wodenokoto 7mo ago
I know e-mail has a faster round-trip, but they also don't ask you to confirm snail mail. I think it would be quite annoying to have to verify my purchase everywhere, just like how I don't wanna sign up to every single merchant online. Let me purchase as guest without having to enter OTPs.
- withinboredom 7mo ago
  Email isn't guaranteed to have a faster round-trip. https://groups.io/email-provider-status https://groups.io/email-provider-status -- sometimes goes into hours of latency.
nobodywillobsrv 7mo ago
Yes it is insane. I am in same boat and have received mortgage applications, police details, applications for police jobs, massage receipts you name it. Many would be considered important leaks of customer data. I have even had founder level emails that presumably are confidential sent to me because I share the name of someone operating in tech. I respond or report when it's obviously some real person running a small group but for large monoliths there is very little to do except quickly reply to corporate email. Really wish there was some kind of high level discussion about building something for this specific problem of non malicious wrong person same name errors. Google could do it it's just not something that is monetizable at a scale they care about IMO and I have not been able to think of a way to make this work operating outside of email monoliths. Would love to hear if anyone has ideas.
- jb1991 7mo ago
  Commend your effort to actually contact the companies to let them know the error. I stopped doing that a long time ago when I stopped getting response or stopped getting any kind of meaningful reaction that I was actually trying to do something good by reporting it.
- fragmede 7mo ago
  What Google has done, is add profile pictures for users, so if I'm emailing girlfriend@gmail.com I get her picture, but if I email giirlfriend@gmail.com, I see someone else's pfp which is enough to get me to realize I've spelled it wrong. I'm sure there's more they could be doing, but they're aware of the problem at least.
  - jb1991 7mo ago
    But that only works if you’re emailing from another Gmail account yes?
letier 7mo ago
I have a very early gmail address. A very common first name plus two letters. It is almost unusable by now. Invoices, subscriptions, important documents about some persons real estate dealings. They all end up in my inbox. I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. I set up a new address that is less likely to end up with this problem. But migrating away from the old one is not easy…
- pixelesque 7mo ago
  Exactly the same situation with me in terms of gmail address (although my names are less common). I get so many other $MY_NAME emails, including bills (including multiple credit cards and things like Afterpay), deliveries, medical details/reports, family communications, etc, etc. And it's very clear that quite a few online services blatantly don't verify email addresses, they just assume the email is valid and allow the person to start using it.
- deltoidmaximus 7mo ago
  > I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. Does google not require a verification when you setup a backup email address?!
  - jb1991 7mo ago
    Yes they do, so I’m not sure how that could be possible. Unless it’s a back up email address for some other email service that doesn’t require it.
    - letier 7mo ago
      You can add any address as a backup email address for a google account. And for some reason there are a number of people that just attached my email address, possibly by mistake.
annie511266728 7mo ago
[dead]
xmcqdpt2 7mo ago
As is often repeated, the optimal amount of fraud is not zero https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/ https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra... They are optimizing towards making it easy to purchase things on a whim.
- jb1991 7mo ago
  As I’ve noted, I’m referring to things far beyond just purchases.
cestith 7mo ago
I get this stuff all the time. Once, I got the information someone requested about a drug company helping cover the cost of a drug for a lower-income individual (who was apparently the one who mistyped his email address). It included his name, city, and some other personal information. The drug was only approved for one medical issue. Total HIPAA/HITECH violation. They didn’t have a HIPAA coordinator by title, so I got to explain how to avoid this to their legal department.
ProllyInfamous 7mo ago
>It’s bonkers to me that there’s any developers out there working for these companies that never thought to implement simple email verification Other POV: I simply do not use email — like at all (don't even have a SPAM account anymore) — if your website requires me to enter an email address just to buy something, I WILL find a burner/temporary email that will allow the transaction script to proceed ("10 minute email"). I am personally grateful when a store allows me to proceed with a guest transaction [i.e. non-login, non-email purchase] — even if that means I might need to "call in" should the transaction be flagged/delayed [usually isn't]. Intentionally not giving examples to avoid hacker/targetting, but many US clothing manufacturers offer these frictionless (and legitimate) purchase pathways.

by jb1991 7mo ago

Gigachad 7mo ago

Because confirming the email introduces friction. And everyone is optimising for low friction even if it risks private data leaks, which you can always blame on the user for typing their email wrong.

pprotas 7mo ago

This is intentional. Email verification is friction, so it gives users a chance to reconsider whether their purchase is really necessary. This is bad for business, because they’d prefer if you were impulsive. Also, people usually type their emails correctly, especially these days with auto-fill. So not sending confirmation emails is optimizing for the happy path.

jb1991 7mo ago
Not just talking about purchases. I receive transaction details with bank numbers for wire transfers around the world. It’s ridiculous. I was once even sent all of the legal proceedings for a court case by a lawyer who was sent to the wrong address.
expedition32 7mo ago
I just recently got a Visa debit card and I have to verify every purchase in my bank app. Absolutely 100 percent fraud and security proof. However as you it is an extra step and I imagine many retailers have done the math between fraud and friction...

plagiarist 7mo ago

I am dismayed that it is legal to create an account attached to an email without validation of that email. It should be straight-up massive fine illegal to send any email other than account confirmation until validated. Validation emails should have a "do not contact me again" that works with a single click and a massive fine if it does not.

wodenokoto 7mo ago

I know e-mail has a faster round-trip, but they also don't ask you to confirm snail mail. I think it would be quite annoying to have to verify my purchase everywhere, just like how I don't wanna sign up to every single merchant online. Let me purchase as guest without having to enter OTPs.

withinboredom 7mo ago
Email isn't guaranteed to have a faster round-trip. https://groups.io/email-provider-status https://groups.io/email-provider-status -- sometimes goes into hours of latency.

nobodywillobsrv 7mo ago

Yes it is insane. I am in same boat and have received mortgage applications, police details, applications for police jobs, massage receipts you name it. Many would be considered important leaks of customer data. I have even had founder level emails that presumably are confidential sent to me because I share the name of someone operating in tech. I respond or report when it's obviously some real person running a small group but for large monoliths there is very little to do except quickly reply to corporate email. Really wish there was some kind of high level discussion about building something for this specific problem of non malicious wrong person same name errors. Google could do it it's just not something that is monetizable at a scale they care about IMO and I have not been able to think of a way to make this work operating outside of email monoliths. Would love to hear if anyone has ideas.

jb1991 7mo ago
Commend your effort to actually contact the companies to let them know the error. I stopped doing that a long time ago when I stopped getting response or stopped getting any kind of meaningful reaction that I was actually trying to do something good by reporting it.
fragmede 7mo ago
What Google has done, is add profile pictures for users, so if I'm emailing girlfriend@gmail.com I get her picture, but if I email giirlfriend@gmail.com, I see someone else's pfp which is enough to get me to realize I've spelled it wrong. I'm sure there's more they could be doing, but they're aware of the problem at least.
- jb1991 7mo ago
  But that only works if you’re emailing from another Gmail account yes?

letier 7mo ago

I have a very early gmail address. A very common first name plus two letters. It is almost unusable by now. Invoices, subscriptions, important documents about some persons real estate dealings. They all end up in my inbox. I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. I set up a new address that is less likely to end up with this problem. But migrating away from the old one is not easy…

pixelesque 7mo ago
Exactly the same situation with me in terms of gmail address (although my names are less common). I get so many other $MY_NAME emails, including bills (including multiple credit cards and things like Afterpay), deliveries, medical details/reports, family communications, etc, etc. And it's very clear that quite a few online services blatantly don't verify email addresses, they just assume the email is valid and allow the person to start using it.
deltoidmaximus 7mo ago
> I have around 20 or 30 google accounts attached where i am the backup email address. Those people forget their passwords or stop using their accounts and i get email notifications about that. No confirmation from my side necessary. Does google not require a verification when you setup a backup email address?!
- jb1991 7mo ago
  Yes they do, so I’m not sure how that could be possible. Unless it’s a back up email address for some other email service that doesn’t require it.
  - letier 7mo ago
    You can add any address as a backup email address for a google account. And for some reason there are a number of people that just attached my email address, possibly by mistake.

annie511266728 7mo ago

[dead]

xmcqdpt2 7mo ago

As is often repeated, the optimal amount of fraud is not zero https://www.bitsaboutmoney.com/archive/optimal-amount-of-fraud/ https://www.bitsaboutmoney.com/archive/optimal-amount-of-fra... They are optimizing towards making it easy to purchase things on a whim.

jb1991 7mo ago
As I’ve noted, I’m referring to things far beyond just purchases.

cestith 7mo ago

I get this stuff all the time. Once, I got the information someone requested about a drug company helping cover the cost of a drug for a lower-income individual (who was apparently the one who mistyped his email address). It included his name, city, and some other personal information. The drug was only approved for one medical issue. Total HIPAA/HITECH violation. They didn’t have a HIPAA coordinator by title, so I got to explain how to avoid this to their legal department.

ProllyInfamous 7mo ago

>It’s bonkers to me that there’s any developers out there working for these companies that never thought to implement simple email verification Other POV: I simply do not use email — like at all (don't even have a SPAM account anymore) — if your website requires me to enter an email address just to buy something, I WILL find a burner/temporary email that will allow the transaction script to proceed ("10 minute email"). I am personally grateful when a store allows me to proceed with a guest transaction [i.e. non-login, non-email purchase] — even if that means I might need to "call in" should the transaction be flagged/delayed [usually isn't]. Intentionally not giving examples to avoid hacker/targetting, but many US clothing manufacturers offer these frictionless (and legitimate) purchase pathways.