2

Since it's a bad practice to ask users to click on a URL within an email to verify their identity due to phishing concerns, what is the best way to ask a user that additional PII information is necessary?

The following example from Stripe.com is asking for an email address, and a subsequent URL to click on.

Aside from emailing the end user, what other channels are best for requesting this information?

If email is the only choice, what is the best approach to ensure that the user will indeed click on the link and proceed with the verification. Our goal is to limit abandoned carts in the event the user doesn't see or ignores this request.

Improve this question
1
  • My bank told me to bookmark their page; their email tells me to use my bookmark to logon, then to navigate to my account and update my data. In every letter they advise me to not click on links in email purporting to come from them. But since you're looking at an online shopping site, you may not have the same kind of trust relationship to rely on.
    – John Deters
    Commented Aug 9, 2016 at 20:34

1 Answer 1

Reset to default
1

This kind of scenario essentially features a trade-off between usuability and security, and which option you decide to go for will depend on the risk appetite of your organisation.

Ideally from a security perspective you should not encourage users to click links in e-mail given the lack of reliability of e-mail and the prevalance of phishing scams which involve getting users to click on links in mails.

So the best option from that perspective would be to send a mail to the customer (or contact them via another channel if they've provided those contact details) and ask them to go to the site themselves in the browser, log in and go from there.

Of course this isn't a great user experience and that's why a lot of companies choose to put links in e-mail for people to click. So if you do do that, some things to consider

  • Try to avoid using 3rd party click tracking sites, so at least the user is going to your domain and can verify that assuming they know what to look for of course.
  • Consider digitally signing your e-mails. Again I'm sure a lot of users won't notice but it helps for those who are more security aware to have some extra confidence that the mail is legitimate.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .