Verify account existence before triggering password reset email
When I tried to log in and couldn't, I requested to reset my password and received the following message:
We've sent you an email to reset your password
You will receive an email from us in the next few minutes. Click on the link in the email to change your password.
After not receiving an email, I tried registering for a new account. It turns out I apparently never had an account.
Before telling users that you are sending a password reset email, maybe CHECK to see if they actually have an account so you can provide useful information?
Anonymous
shared this idea
-
Adminvchou
(Admin, Box)
commented
If users can't remember whether they have an account or can't remember their password, sometimes they try the reset password. Currently, entering any text with an "@" in the middle will give the same confirmation page that an email has been sent. The current default messaging advises those who haven't received the email to 1) check their spam or 2) try a different email. I would suggest adding additional messaging around the *possibility* of there never being an account in the first place. e.g. "If an account was found, an email has been sent" or "Another reason why you may not have received an email is.."