Handling users who change their email address

A customer changes jobs and wants their account to use a new email address. In your settings page this is one field and one button. Behind it sits one of the most sensitive actions in your product, because for most apps the email address is the key to the account: it receives password resets, magic links and security alerts. Whoever controls the address can take over the account.

This guide describes a safe flow for changing an email address, the emails it should send, and the other systems that need to hear about it. The aim is to make the honest case painless and the hostile case hard.

Why this flow is risky#

• An attacker with a stolen session can lock the owner out. If changing the address needs nothing more than being logged in, a hijacked session can swap in an attacker's address, then reset the password and finish the takeover.
• A typo can lock the owner out. Switching to an address nobody can read leaves the account with no way to recover.
• The old address often matters more than people think. It may still be the one in billing records, in support threads and on invoices.
• Many systems hold a copy. Your payment provider, your support tool, your analytics and your marketing platform each have their own record of the address.

The flow, step by step#

1. Ask for proof it is really the owner#

Before accepting a change, confirm that the person in front of you is the account holder, not just a browser with a live session. The usual choices are the current password, a code from an authenticator app, or a fresh sign-in. If the person has no password because they use a magic link or Google sign-in, ask for a recent sign-in instead. Magic links vs email OTP covers the trade-offs in those flows.

2. Validate and normalize the new address#

Check the syntax, trim spaces and compare using the same key you use at signup, so that [email protected] and [email protected] are treated as one address. Normalizing email addresses in your user table explains how. Then check that no other account already uses it. Be careful what the form says: answering "that address is already registered" lets anyone test whether a person has an account. A neutral message, with the real answer sent to the address's owner by email, is better. Email validation at signup has more on what to check and what to skip.

3. Do not change anything yet: verify the new address#

Store the new address as pending, and email a confirmation link or code to it. The account keeps working with the old address until the new one is confirmed. This catches typos, and it proves the person controls the new mailbox.

Make the link:

• single-use and tied to this account and this pending address,
• short-lived, for example an hour,
• confirmed only while the person is signed in or after a fresh sign-in, so a leaked link alone is not enough.

If the person starts another change before confirming, replace the pending address and cancel the older link.

4. Warn the old address#

Send a message to the current address as soon as the change is requested, and again once it takes effect. It should say what is happening, when and from where, and offer a way to stop it:

We received a request to change the email on your account from [email protected] to [email protected], from a browser in Lisbon at 14:05 UTC. If this was you, no action is needed. If it was not, cancel it here and change your password.

The notice to the old address is the single most useful defence, because the real owner may be the only one who reads it in time.

5. Offer a way back#

For a limited period after the change, for example 7 to 14 days, keep a revert link in the notice to the old address. Using it restores the old address, signs out all other sessions and asks for a password reset. Some products also delay the switch itself by a day or two for accounts holding valuable data, which gives the owner time to react.

6. Sign out other sessions#

Once the new address is confirmed, end other sessions and refresh tokens, or at least ask the person if they want to. If a hostile session was involved, this closes it. Keep the current session alive so the person is not thrown out of the page they are on.

7. Confirm, then clean up#

Send a confirmation to the new address ("Your email is now [email protected]"), and update the account. Record the change in an audit log: who, when, from where, the old and new address. The old address should not be reusable by a different account for a short time, so it cannot be claimed and used to receive leftover mail.