Changing A User’s Registered Email Address

Last updated: February 8, 2026Reviewed date: February 8, 2026Reading time: 12 min read
Patient Tools

Read, save, and share this guide

Use these quick tools to make this medical article easier to read, print, save, or share with a family member.

Article Summary

In many systems, a User's email address is used for identity. The process below is the recommended method to implement in a system to handle the situation when a User would like to change that registered email address. NOTE: The process is less stringent when using Multifactor Authentication because the proof-of-identity is stronger than just using a password. Flowchart [comment]: <> The source code used for rendering...

Key Takeaways

  • This article explains Flowchart in simple medical language.
  • This article explains Recommended Process If The User Has Only One Email Address Associated With Their User Account -- AND Multifactor Authentication Enabled in simple medical language.
  • This article explains Recommended Process If The User Has Only One Email Address Associated With Their User Account -- AND DOES NOT HAVE Multifactor Authentication Enabled in simple medical language.
  • This article explains Notes on the Above Processes in simple medical language.
Educational health guideWritten for patient understanding and clinical awareness.
Reviewed content workflowUse writer and reviewer profiles for stronger trust.
Emergency safety firstUrgent warning signs are highlighted below.

Seek urgent medical care if you notice

These warning signs are general safety guidance. Local emergency numbers and clinical judgment should always come first.

  • Severe symptoms, breathing difficulty, fainting, confusion, or rapidly worsening illness.
  • New weakness, severe pain, high fever, or symptoms after a serious injury.
  • Any symptom that feels urgent, unusual, or unsafe for the patient.
1

Emergency now

Use emergency care for severe, sudden, rapidly worsening, or life-threatening symptoms.

2

See a doctor

Book a professional medical evaluation if symptoms persist, worsen, recur often, affect daily activities, or occur in a high-risk patient.

3

Learn safely

Use this article to understand possible causes, tests, treatment options, prevention, and questions to ask your clinician.

In many systems, a User’s email address is used for identity. The process below is the recommended method to implement in a system to handle the situation when a User would like to change that registered email address.

NOTE: The process is less stringent when using Multifactor Authentication because the proof-of-identity is stronger than just using a password.

Flowchart

[comment]: <> The source code used for rendering this flowchart is in [/assets/controls/src/plantuml/Changing_Registered_Email_Address_For_An_Account.puml]({{ site.baseurl }}/assets/controls/src/plantuml/Changing_Registered_Email_Address_For_An_Account.puml). [comment]: <> See [/assets/controls/src/plantuml/README.md]({{ site.baseurl }}/assets/controls/src/plantuml/README.md) for information about PlantUML [comment]: <> Good luck! [comment]: <> /Philip H. Schlesinger [comment]: <> Original Author of this Control

![Image:Changing_Registered_Email_Address_In_A_System_Flowchart.png]({{ site.baseurl }}/assets/images/controls/Changing_Registered_Email_Address_In_A_System_Flowchart.png)

  1. The System shall confirm the User’s authentication cookie/token is still valid; if not, the System should display a login screen.
  2. To reduce User friction, the System shall describe to the User the process that the User will be expected to follow to change their registered email address within the System.
  3. The System shall ask the User to submit a proposed-new email address. The System shall not continue this process unless the proposed-new email address meets the System’s rules for registered email addresses.
  4. The System shall ask the User to use Multifactor Authentication to prove their identity. The System shall not continue this process until the Multifactor Authentication submission is successful.
  5. The System shall now store in the data-store the proposed-new email address in a way that represents this as the “proposed-new email address for that User’s account in the System” AND NOT the actual registered email address.
  6. The System shall now create and store in the System data-store two separate time-limited nonces associated with the User’s account — making sure to not duplicate any existing nonces in the data-store:
    1. A nonce to be used to notify the System to, in turn, directly notify the System Administrators that the request to change the registered email address was unexpected and should be investigated immediately.
    2. A separate nonce to be used to notify the System that the User has confirmed the proposed-new email address is both (a) valid, and (b) within the User’s control.
  7. The System shall now send out two email messages to confirm that the change is valid:
    1. A notification-only email message to the still-currently-registered email address stating that the registered email address for the User on the System is about to change — and if this is unexpected to either:
      • Click the specified link within the email message within the specified time-limit; this link shall include the nonce for notifying System Administrators that the request was unexpected
      • AND / OR
      • Contact Customer Service / Help Desk via a specified phone number or email address
    2. A separate confirmation-required email message to the proposed-new email address stating that the registered email address for the User on the System has been requested to change and:
      • IF this IS expected
        • THEN the User should click the link with the nonce confirming the change is expected within the specified time limit.
      • IF this IS NOT expected,
        • THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected
        • AND / OR
        • Contact Customer Service / Help Desk via a specified phone number or email address
  8. WHEN the System receives a request from the link with a nonce to notify System Administrators that the request to change the registered email address was unexpected:
    • IF the nonce in that link has not expired by that time
      • THEN the System shall notify System Administrators that a change to a registered email address was identified as unexpected — and to figure out what happened immediately via human means.
    • On the other hand:
      • IF the nonce in that link has expired,
        • THEN the System shall:
          • FIRST remove that now-detected-as-expired nonce from the System data-store.
          • AND THEN state to the User that the request is invalid.
    • In the case that the nonce in the link cannot be found:
      • The System shall state to the User that the request is invalid.
  9. WHEN the System receives a request from the link with a nonce to confirm to the System that the request to change the registered email address is valid:
    • IF the nonce in that link has not expired by that time
      • THEN the System shall:
        • FIRST update the data-store to change the registered email address to the proposed-new email address for the User.
        • SECOND log out the User / invalidate the User’s authentication token/cookie from the System
        • THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentials
    • On the other hand:
      • IF the nonce in that link has expired
      • THEN the System shall:
        • FIRST remove that now-detected-as-expired nonce from the System data-store.
        • AND THEN state to the User that the request is invalid.
    • In the case that the nonce in the link cannot be found:
      • The System shall state to the User that the request is invalid.
  1. The System shall confirm the User’s authentication cookie/token is still valid; if not, the System should display a login screen.
  2. To reduce User friction, the System shall describe to the User the process that the User will be expected to follow to change their registered email address within the System.
  3. The System shall ask the User to submit a proposed-new email address. The System shall not continue this process unless the proposed-new email address meets the System’s rules for registered email addresses.
  4. The System shall ask the User to provide their current password to prove their identity. The System shall not continue this process until the password submitted matches the User’s current password.
  5. The System shall now store in the data-store the proposed-new email address in a way that represents this as the “proposed-new email address for that User’s account in the System” AND NOT the actual registered email address.
  6. The System shall now create and store in the System data-store three separate time-limited nonces associated with the User’s account — making sure to not duplicate any existing nonces in the data-store:
    1. A nonce to be used to notify the System to, in turn, directly notify the System Administrators that the request to change the registered email address was unexpected and should be investigated immediately.
    2. A separate nonce to be used to notify the System that the User has confirmed from their still-currently-registered email address that the change of registered email address is ok.
      • NOTE: this extra step may cause User friction; however, OWASP recommends this step because many Users (a) choose easily-guessed passwords, and (b) repeat passwords across multiple systems.
    3. Another separate nonce to be used to notify the System that the User has confirmed the proposed-new email address is both (a) valid, and (b) within the User’s control.
  7. The System shall now send out two email messages to confirm that the change is valid:
    1. A confirmation-required email message to the still-currently-registered email address stating that the registered email address for the User on the System has been requested to change and:
      • IF this IS expected,
        • THEN the User should click the link with the nonce confirming the change is expected within the specified time limit.
      • IF this IS NOT expected,
        • THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected
        • AND / OR
        • Contact Customer Service / Help Desk via a specified phone number or email address
    2. A separate confirmation-required email message to the proposed-new email address stating that the registered email address for the User on the System has been requested to change and:
      • IF this IS expected,
        • THEN the User should click the link with the nonce confirming the change is expected within the specified time limit.
      • IF this IS NOT expected,
        • THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected
        • AND / OR
        • Contact Customer Service / Help Desk via a specified phone number or email address
  8. WHEN the System receives a request from the link with a nonce to notify System Administrators that the request to change the registered email address was unexpected:
    • IF the nonce in that link has not expired by that time
      • THEN the System shall notify System Administrators that a change to a registered email address was identified as unexpected — and to figure out what happened immediately via human means.
    • On the other hand:
      • IF the nonce in that link has expired
      • THEN the System shall:
        • FIRST remove that now-detected-as-expired nonce from the System data-store.
        • AND THEN state to the User that the request is invalid.
    • In the case that the nonce in the link cannot be found:
      • The System shall state to the User that the request is invalid.
  9. WHEN the System receives a request from the link with the nonce to confirm to the System that the User has confirmed the request to change the registered email address from the still-currently-registered email address:
    • IF the nonce in that link has not expired by that time AND IF the User HAS already confirmed the change of the registered email address from the message to the proposed-new email address
      • THEN the System shall:
        • FIRST update the data-store to change the registered email address to the proposed-new email address for the User.
        • SECOND log out the User / invalidate the User’s authentication token/cookie from the System
        • THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentials
    • On the other hand:
      • IF the nonce in that link has not expired by that time AND IF the User HAS NOT already confirmed the change of the registered email address from the message to the proposed-new email address
        • THEN the System shall inform the User that they now just need to click the confirmation link in the email message to the proposed-new email address
    • On the other hand:
      • IF the nonce in that link has expired
      • THEN the System shall:
        • FIRST remove that now-detected-as-expired nonce from the System data-store.
        • AND THEN state to the User that the request is invalid.
    • In the case that the nonce in the link cannot be found:
      • The System shall state to the User that the request is invalid.
  10. WHEN the System receives a request from the link with the nonce to confirm to the System that the User has confirmed the request to change the registered email address from the proposed-new email address:
    • IF the nonce in that link has not expired by that time AND IF the User HAS already confirmed the change of the registered email address from the message to the still-currently-registered email address
      • THEN the System shall:
        • FIRST update the data-store to change the registered email address to the proposed-new email address for the User.
        • SECOND log out the User / invalidate the User’s authentication token/cookie from the System
        • THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentials
    • On the other hand:
      • IF the nonce in that link has not expired by that time AND IF the User HAS NOT already confirmed the change of the registered email address from the message to the proposed-new email address
        • THEN the System shall inform the User that they now just need to click the confirmation link in the email message to the proposed-new email address
    • On the other hand:
      • IF the nonce in that link has expired
      • THEN the System shall:
        • FIRST remove that now-detected-as-expired nonce from the System data-store.
        • AND THEN state to the User that the request is invalid.
    • In the case that the nonce in the link cannot be found:
      • The System shall state to the User that the request is invalid.

Notes on the Above Processes

Google Thinks Differently

IF a User of Google only has their account protected with a password, when someone submits a change of registered email address, if the submitter knows the User’s password, Google just sends a notification-only email message to the currently-registered email address for that Google User with a link for “I didn’t request this email address change”.

This is risky:

The User’s password might be easily-guessable — or might be a repeated password stolen from another website where the User is registered.

Nevertheless, Google apparently is still ok with the risk that the request might be unauthorized. Hopefully the real User will see the email message to the soon-to-be originally-registered email address and click the “this is unexpected” link before the “this is unexpected” nonce expires.

What If The Above Identity-Proofs Are Compromised?

For completeness, the following statements have been added:

If the User has Multifactor Authentication enabled for their System account — and that Multifactor Authentication is compromised, then the User will be vulnerable to having their registered email address changed for the System. The only hope of stopping the change is for the User to monitor the inbox of the currently-registered email address.

If the inbox for the currently-registered email address is compromised, then the User will be vulnerable to all types of attacks that rely on the trustworthiness of that email address. See [Intrusion Detection]({{ site.baseurl }}/controls/Intrusion_Detection).

What If The Currently-Registered Email Address Is Inaccessible / Gone?

The only option then is for the User to contact the System Administrators out-of-band. Which leads to the next item:

Regular Social Engineering Training Is Essential

In the event someone contacts a System’s System Administrator or Help Desk to request the change of a registered email address stating they are unable to go through the above process, the System Administrator / Help Desk has to either:

(a) be instructed to refuse to make any changes that do not follow the above process

— or —

(b) be instructed on best-practice alternative methods of verifying the person’s identity before making changes that do not follow the above process

OWASP recommends regularly training staff on how to identify and respond to social engineering attacks. However, as of this writing (2023-12-01), OWASP does not offer social engineering training.

For a brief guide, see the United States Cybersecurity & Infrastructure Agency’s (CISA) “Avoiding Social Engineering and Phishing Attacks”.

What About Systems Where User Accounts Can Register Multiple Email Addresses?

That will be described in a forthcoming revision of this document. Content proposals are encouraged.

Patient safety assistant

Check your symptom safely

Hi, I am RX Symptom Navigator. I can help you understand what to read next and what warning signs need care.
Warning: Do not use this in emergencies, pregnancy, severe illness, or as a substitute for a doctor. For children or teens, use with a parent/guardian and clinician.
A rural-friendly guide: warning signs, when to see a doctor, related articles, tests to discuss, and OTC safety education.
1 Symptom 2 Severity 3 Safe guidance
First safety question

Is there chest pain, breathing trouble, fainting, confusion, severe bleeding, stroke-like weakness, severe injury, or pregnancy danger sign?

Choose quickly

Browse by body area
Start here: Write or select a symptom. The guide will show warning signs, doctor guidance, diagnostic tests to discuss, OTC safety education, and related RX articles.

Important: This tool is educational only. It cannot diagnose, treat, or replace a doctor. OTC information is not a prescription. In an emergency, contact local emergency services or go to the nearest hospital.

Doctor visit helper

Prepare before seeing a doctor

A simple rural-patient checklist to help you explain symptoms clearly, ask better questions, and avoid unsafe self-treatment.

Safety note: This is not a prescription or diagnosis. For severe symptoms, pregnancy danger signs, children with serious illness, chest pain, breathing difficulty, stroke-like weakness, or major injury, seek urgent care.

Which doctor may help?

Start with a registered doctor or the nearest qualified health center.

What to tell the doctor

  • Write when the problem started and how it changed.
  • Bring old prescriptions, investigation reports, and current medicines.
  • Write allergies, pregnancy status, diabetes, kidney/liver disease, and major past illnesses.
  • Bring one family member if the patient is weak, elderly, confused, or a child.

Questions to ask

  • What is the most likely cause of my symptoms?
  • Which danger signs mean I should go to hospital quickly?
  • Which tests are necessary now, and which can wait?
  • How should I take medicines safely and what side effects should I watch for?
  • When should I come for follow-up?

Tests to discuss

  • Vital signs: temperature, pulse, blood pressure, oxygen saturation
  • Basic physical examination by a clinician
  • CBC, urine test, blood sugar, or imaging only when clinically needed

Avoid these mistakes

  • Do not use antibiotics, steroid tablets/injections, or strong painkillers without proper medical advice.
  • Do not hide pregnancy, kidney disease, ulcer, allergy, or blood thinner use.
  • Do not delay emergency care when danger signs are present.

Medicine safety and first-aid guide

This section is for patient education only. It does not replace a doctor, pharmacist, or emergency care.

Safe first steps

  • Rest, drink safe water, and observe symptoms carefully.
  • Keep a written note of symptoms, duration, temperature, medicines already taken, and allergy history.
  • Seek medical care quickly if symptoms are severe, worsening, or unusual for the patient.

OTC medicine safety

  • For mild pain or fever, ask a registered pharmacist or doctor before using common over-the-counter pain/fever medicines.
  • Do not combine multiple pain medicines without advice, especially if you have kidney disease, liver disease, stomach ulcer, asthma, pregnancy, or take blood thinners.
  • Do not give adult medicines to children unless a qualified clinician advises it.

Avoid these mistakes

  • Do not start antibiotics without a proper medical decision.
  • Do not use steroid tablets or injections casually for quick relief.
  • Do not delay emergency care because of home remedies.

Get urgent help if

  • Severe symptoms, confusion, fainting, breathing difficulty, chest pain, severe dehydration, or sudden weakness need urgent medical care.
Medicine names, dose, and timing must be decided by a qualified clinician or pharmacist after checking age, pregnancy, allergy, other diseases, and current medicines.

For rural patients and family caregivers

Patient health record and symptom diary

Write your symptoms, medicines already taken, test results, and questions before visiting a doctor. This note stays on your device unless you print or copy it.

Doctor to discuss: Doctor / qualified healthcare provider
Tests to discuss with doctor
  • Basic vital signs: temperature, pulse, blood pressure, oxygen level if needed
  • Relevant blood, urine, imaging, or specialist tests only after clinical assessment
Questions to ask
  • What is the most likely cause of my symptoms?
  • Which warning signs mean I should go to emergency care?
  • Which tests are really needed now?
  • Which medicines are safe for my age, pregnancy status, allergy, kidney/liver/stomach condition, and current medicines?

Emergency warning signs such as chest pain, severe breathing difficulty, sudden weakness, confusion, severe dehydration, major injury, or loss of bladder/bowel control need urgent medical care. Do not wait for online information.

Safe pathway to proper treatment

Patient care roadmap

Use this simple roadmap to understand the next safe steps. It is educational and does not replace examination by a doctor.

Go to emergency care if you notice:
  • Severe or rapidly worsening symptoms
  • Breathing difficulty, chest pain, fainting, confusion, severe weakness, major injury, or severe dehydration
Doctor / service to discuss: Qualified healthcare provider; specialist depends on symptoms and examination.
  1. Step 1

    Check danger signs first

    If danger signs are present, seek emergency care and do not wait for online information.

  2. Step 2

    Record the symptom story

    Write when symptoms started, severity, medicines already taken, allergies, pregnancy status, and test results.

  3. Step 3

    Visit a qualified clinician

    A doctor, nurse, or qualified healthcare provider can examine you and decide which tests or treatment are needed.

  4. Step 4

    Do only useful tests

    Do tests after clinical assessment. Avoid unnecessary tests, random antibiotics, or repeated medicines without diagnosis.

  5. Step 5

    Follow up and return early if worse

    If symptoms worsen, new warning signs appear, or treatment is not helping, return for review quickly.

Rural patient practical tips
  • Take a written symptom diary and all previous prescriptions/test reports.
  • Do not hide medicines already taken, even herbal or over-the-counter medicines.
  • Ask which warning signs mean urgent referral to hospital.

This roadmap is for education. A real diagnosis and treatment plan requires history, examination, and clinical judgment.

RX Patient Help

Ask a health question safely

Write your symptom story. A health professional or site editor can review it before any answer is prepared. This box is not for emergency care.

Emergency first: Severe chest pain, breathing trouble, unconsciousness, stroke signs, severe injury, heavy bleeding, or rapidly worsening symptoms need urgent local medical care now.

Frequently Asked Questions

Flowchart [comment]: <> The source code used for rendering this flowchart is in [/assets/controls/src/plantuml/Changing_Registered_Email_Address_For_An_Account.puml]({{ site.baseurl }}/assets/controls/src/plantuml/Changing_Registered_Email_Address_For_An_Account.puml). [comment]: <> See [/assets/controls/src/plantuml/README.md]({{ site.baseurl }}/assets/controls/src/plantuml/README.md) for information about PlantUML [comment]: <> Good luck! [comment]: <> /Philip H. Schlesinger [comment]: <> Original Author of this Control ![Image:Changing_Registered_Email_Address_In_A_System_Flowchart.png]({{ site.baseurl }}/assets/images/controls/Changing_Registered_Email_Address_In_A_System_Flowchart.png)Recommended Process If The User Has Only One Email Address Associated With Their User Account -- AND Multifactor Authentication EnabledThe System shall confirm the User's authentication cookie/token is still valid; if not, the System should display a login screen. To reduce User friction, the System shall describe to the User the process that the User will be expected to follow to change their registered email address within the System. The System shall ask the User to submit a proposed-new email address. The System shall not continue this process unless the proposed-new email address meets the System's rules for registered email addresses. The System shall ask the User to use Multifactor Authentication to prove their identity. The System shall not continue this process until the Multifactor Authentication submission is successful. The System shall now store in the data-store the proposed-new email address in a way that represents this as the "proposed-new email address for that User's account in the System" AND NOT the actual registered email address. The System shall now create and store in the System data-store two separate time-limited nonces associated with the User's account -- making sure to not duplicate any existing nonces in the data-store:A nonce to be used to notify the System to, in turn, directly notify the System Administrators that the request to change the registered email address was unexpected and should be investigated immediately. A separate nonce to be used to notify the System that the User has confirmed the proposed-new email address is both (a) valid, and (b) within the User's control.The System shall now send out two email messages to confirm that the change is valid:A notification-only email message to the still-currently-registered email address stating that the registered email address for the User on the System is about to change -- and if this is unexpected to either:Click the specified link within the email message within the specified time-limit; this link shall include the nonce for notifying System Administrators that the request was unexpected AND / OR Contact Customer Service / Help Desk via a specified phone number or email addressA separate confirmation-required email message to the proposed-new email address stating that the registered email address for the User on the System has been requested to change and:IF this IS expectedTHEN the User should click the link with the nonce confirming the change is expected within the specified time limit.IF this IS NOT expected,THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected AND / OR Contact Customer Service / Help Desk via a specified phone number or email addressWHEN the System receives a request from the link with a nonce to notify System Administrators that the request to change the registered email address was unexpected:IF the nonce in that link has not expired by that timeTHEN the System shall notify System Administrators that a change to a registered email address was identified as unexpected -- and to figure out what happened immediately via human means.On the other hand:IF the nonce in that link has expired,THEN the System shall:FIRST remove that now-detected-as-expired nonce from the System data-store. AND THEN state to the User that the request is invalid.In the case that the nonce in the link cannot be found:The System shall state to the User that the request is invalid.WHEN the System receives a request from the link with a nonce to confirm to the System that the request to change the registered email address is valid:IF the nonce in that link has not expired by that timeTHEN the System shall:FIRST update the data-store to change the registered email address to the proposed-new email address for the User. SECOND log out the User / invalidate the User's authentication token/cookie from the System THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentialsOn the other hand:IF the nonce in that link has expired THEN the System shall:FIRST remove that now-detected-as-expired nonce from the System data-store. AND THEN state to the User that the request is invalid.In the case that the nonce in the link cannot be found:The System shall state to the User that the request is invalid.Recommended Process If The User Has Only One Email Address Associated With Their User Account -- AND DOES NOT HAVE Multifactor Authentication EnabledThe System shall confirm the User's authentication cookie/token is still valid; if not, the System should display a login screen. To reduce User friction, the System shall describe to the User the process that the User will be expected to follow to change their registered email address within the System. The System shall ask the User to submit a proposed-new email address. The System shall not continue this process unless the proposed-new email address meets the System's rules for registered email addresses. The System shall ask the User to provide their current password to prove their identity. The System shall not continue this process until the password submitted matches the User's current password. The System shall now store in the data-store the proposed-new email address in a way that represents this as the "proposed-new email address for that User's account in the System" AND NOT the actual registered email address. The System shall now create and store in the System data-store three separate time-limited nonces associated with the User's account -- making sure to not duplicate any existing nonces in the data-store:A nonce to be used to notify the System to, in turn, directly notify the System Administrators that the request to change the registered email address was unexpected and should be investigated immediately. A separate nonce to be used to notify the System that the User has confirmed from their still-currently-registered email address that the change of registered email address is ok.NOTE: this extra step may cause User friction; however, OWASP recommends this step because many Users (a) choose easily-guessed passwords, and (b) repeat passwords across multiple systems.Another separate nonce to be used to notify the System that the User has confirmed the proposed-new email address is both (a) valid, and (b) within the User's control.The System shall now send out two email messages to confirm that the change is valid:A confirmation-required email message to the still-currently-registered email address stating that the registered email address for the User on the System has been requested to change and:IF this IS expected,THEN the User should click the link with the nonce confirming the change is expected within the specified time limit.IF this IS NOT expected,THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected AND / OR Contact Customer Service / Help Desk via a specified phone number or email addressA separate confirmation-required email message to the proposed-new email address stating that the registered email address for the User on the System has been requested to change and:IF this IS expected,THEN the User should click the link with the nonce confirming the change is expected within the specified time limit.IF this IS NOT expected,THEN the User should click another specified link within the email message within the specified time limit; this link shall include the nonce for notifying System Administrators that the request was unexpected AND / OR Contact Customer Service / Help Desk via a specified phone number or email addressWHEN the System receives a request from the link with a nonce to notify System Administrators that the request to change the registered email address was unexpected:IF the nonce in that link has not expired by that timeTHEN the System shall notify System Administrators that a change to a registered email address was identified as unexpected -- and to figure out what happened immediately via human means.On the other hand:IF the nonce in that link has expired THEN the System shall:FIRST remove that now-detected-as-expired nonce from the System data-store. AND THEN state to the User that the request is invalid.In the case that the nonce in the link cannot be found:The System shall state to the User that the request is invalid.WHEN the System receives a request from the link with the nonce to confirm to the System that the User has confirmed the request to change the registered email address from the still-currently-registered email address:IF the nonce in that link has not expired by that time AND IF the User HAS already confirmed the change of the registered email address from the message to the proposed-new email addressTHEN the System shall:FIRST update the data-store to change the registered email address to the proposed-new email address for the User. SECOND log out the User / invalidate the User's authentication token/cookie from the System THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentialsOn the other hand:IF the nonce in that link has not expired by that time AND IF the User HAS NOT already confirmed the change of the registered email address from the message to the proposed-new email addressTHEN the System shall inform the User that they now just need to click the confirmation link in the email message to the proposed-new email addressOn the other hand:IF the nonce in that link has expired THEN the System shall:FIRST remove that now-detected-as-expired nonce from the System data-store. AND THEN state to the User that the request is invalid.In the case that the nonce in the link cannot be found:The System shall state to the User that the request is invalid.WHEN the System receives a request from the link with the nonce to confirm to the System that the User has confirmed the request to change the registered email address from the proposed-new email address:IF the nonce in that link has not expired by that time AND IF the User HAS already confirmed the change of the registered email address from the message to the still-currently-registered email addressTHEN the System shall:FIRST update the data-store to change the registered email address to the proposed-new email address for the User. SECOND log out the User / invalidate the User's authentication token/cookie from the System THIRD inform the User that (a) the change of registered email address was successful (b) the User has been logged out and should now log in with their usual login credentialsOn the other hand:IF the nonce in that link has not expired by that time AND IF the User HAS NOT already confirmed the change of the registered email address from the message to the proposed-new email addressTHEN the System shall inform the User that they now just need to click the confirmation link in the email message to the proposed-new email addressOn the other hand:IF the nonce in that link has expired THEN the System shall:FIRST remove that now-detected-as-expired nonce from the System data-store. AND THEN state to the User that the request is invalid.In the case that the nonce in the link cannot be found:The System shall state to the User that the request is invalid.Notes on the Above Processes Google Thinks Differently IF a User of Google only has their account protected with a password, when someone submits a change of registered email address, if the submitter knows the User's password, Google just sends a notification-only email message to the currently-registered email address for that Google User with a link for "I didn't request this email address change". This is risky: The User's password might be easily-guessable -- or might be a repeated password stolen from another website where the User is registered. Nevertheless, Google apparently is still ok with the risk that the request might be unauthorized. Hopefully the real User will see the email message to the soon-to-be originally-registered email address and click the "this is unexpected" link before the "this is unexpected" nonce expires.What If The Above Identity-Proofs Are Compromised?

For completeness, the following statements have been added: If the User has Multifactor Authentication enabled for their System account -- and that Multifactor Authentication is compromised, then the User will be vulnerable to having their registered email address changed for the System. The only hope of stopping the change is for the User to monitor the inbox of the currently-registered email address. If the inbox for the currently-registered email address is compromised, then the User will be vulnerable to all types of…

What If The Currently-Registered Email Address Is Inaccessible / Gone?

The only option then is for the User to contact the System Administrators out-of-band. Which leads to the next item:

Regular Social Engineering Training Is Essential In the event someone contacts a System's System Administrator or Help Desk to request the change of a registered email address stating they are unable to go through the above process, the System Administrator / Help Desk has to either: (a) be instructed to refuse to make any changes that do not follow the above process -- or -- (b) be instructed on best-practice alternative methods of verifying the person's identity before making changes that do not follow the above process OWASP recommends regularly training staff on how to identify and respond to social engineering attacks. However, as of this writing (2023-12-01), OWASP does not offer social engineering training. For a brief guide, see the United States Cybersecurity & Infrastructure Agency's (CISA) "Avoiding Social Engineering and Phishing Attacks".What About Systems Where User Accounts Can Register Multiple Email Addresses?

That will be described in a forthcoming revision of this document. Content proposals are encouraged.

References

Add references, clinical guidelines, textbooks, journal articles, or trusted medical sources here. You can edit this area from the RX Article Professional Blocks panel.

More from this topic
  1. Transient Blockage of the Internal Iliac Artery

    The internal iliac artery is a crucial blood vessel in the pelvis, responsible for supplying blood to various organs and tissues in the lower abdomen and...

    January 25, 2024 • Rx iT World Hacking Tutorial
  2. GraphQL

    GraphQL is an open source query language originally developed by Facebook that can be used to build APIs as an alternative to REST and SOAP. It has...

    January 25, 2024 • Rx iT World Hacking Tutorial
  3. Forgot Password Service

    In order to implement a proper user management system, systems integrate a Forgot Password service that allows the user to request a password reset. Even though this functionality...

    January 25, 2024 • Rx iT World Hacking Tutorial
  4. File upload

    File upload is becoming a more and more essential part of any application, where the user is able to upload their photo, their CV, or a...

    January 25, 2024 • Rx iT World Hacking Tutorial
  5. Error Handling

    Error handling is a part of the overall security of an application. Except in movies, an attack always begins with a Reconnaissance phase in which the attacker will...

    January 25, 2024 • Rx iT World Hacking Tutorial
  6. The .NET Framework

    The .NET Framework is Microsoft’s principal platform for enterprise development. It is the supporting API for ASP.NET, Windows Desktop applications, Windows Communication Foundation services, SharePoint, Visual...

    January 25, 2024 • Rx iT World Hacking Tutorial
  7. Docker Containerization Technology

    Docker is the most popular containerization technology. Upon proper use, it can increase the level of security (in comparison to running applications directly on the host)....

    January 25, 2024 • Rx iT World Hacking Tutorial
  8. Django framework is a powerful Python web framework

    The Django framework is a powerful Python web framework, and it comes with built-in security features that can be used out-of-the-box to prevent common web vulnerabilities....

    January 25, 2024 • Rx iT World Hacking Tutorial
  9. Django REST Framework

    The Django REST framework abstracts developers from quite a bit of tedious work and provides the means to build APIs quickly and with ease using Django....

    January 24, 2024 • Rx iT World Hacking Tutorial
  10. Guidance on Deserializing Objects Safely

    Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order to save them for...

    January 24, 2024 • Rx iT World Hacking Tutorial