Monday, May 25, 2015

password - Is it necessary to verify a user's email address?


It's pretty much a fact that users hate having to open a new tab, go to their email service, log in, wait for the email to arrive and then click a link/paste a code.


Is it really necessary to do this though? The only reason I ask for an email address is for if the user has forgotten their password. But, my thinking is, it's up to them if they want to run the risk of not being able to reset their password.


Should I verify their email address, or should I just warn them that should they enter an invalid email then they won't be able to reset their password if they ever lose it?



Answer



We have spent the last months battling with what to do with email confirmation/verification - prior the user had to give all their details at sign up (way too many actually!) but couldn't actually login until they had confirmed their email address by clicking a link.



We stood back and looked at why we did this - three reasons really, one being we wanted users to be able to reset their password etc but also because we wanted to assured of the identity of anyone interacting with our application and this was one small way of doing so. Additionally, we wanted to know the country, industry, employees etc for our clients for marketing reasons but this is flawed as we have literally HUNDREDS of signups for companies called some variation of TEST with 1 employee working in accounting.


The problem we had was emails sometimes don't get delivered - whether it is for technical reasons or simply delays or people entering the wrong email address/typos and this was creating work for our support team but also making a poor first impression for the prospective client.


A few weeks ago we made two major decisions - we now allow clients to signup by just giving us their email address with no requirement for confirmation.


Upon doing so they are immediately logged in (so no waiting) and, in the background, an email is sent asking them to set their password by clicking a link.


This email, in effect, works as a verification email - if they were never serious and were just tyre kicking then they will either have entered a dummy email address or they will never confirm in which case we are no worse off. Indeed by asking for them to create a password we could be better off as only those who are serious and / or like what the application does and looks like etc will actually do so.


If they are serious then they need to create a password to be able to login next time - we are working through more notification within the application to let clients know they need to create their password etc but, as of this morning, we have had ZERO support emails in the last three week raised due to non receipt of signup emails.


There has been a drop in confirmed signups which we expected but this, in itself, is pretty meaningless as previously they would have signed up, kicked the tyres and never logged in again whereas now they signup, kick the tyres and just don't create a password. We need to work through the overall impact in terms of accounts created, number of users and other success metrics etc but, overall, it looks positive.


I still believe we have a need for some sort of email and identity confirmation - the way we now approach it is slightly different to how we did before but it gives the same outcome without being a barrier to the customers initial experience and first impressions and that was what was most important to us.


UPDATE:


Just thought I would update this with some stats - we changed our signup process on 28/10/2013. Below are two charts - first one shows confirmed signups (i.e. those who have then gone on to create a password) and the second shows all signups which is more akin to prior data points where all accounts were confirmed before being able to login.



As you can see, there is a drop off in the first chart where almost half of those who signup do not confirm / create a password (this maps to our current stats which shows around that percentage who only login once) and the second chart shows that, at the top end, this has not impacted signups with the number of signups remaining fairly consistent pre and post making the change.


enter image description here


enter image description here


No comments:

Post a Comment

technique - How credible is wikipedia?

I understand that this question relates more to wikipedia than it does writing but... If I was going to use wikipedia for a source for a res...