Is it safe to send verification code in the subject of the email?

Question

I am wondering if it's safe to send the signup, reset password, 6 digit verification code in the subject of the email.

Example: "Welcome to the Application, Your verification code is XXXXXX"

The purpose of sending the verification code in the subject is to make it easily accessible on mobile devices. Instead of opening the email, a user can simply see the code from the notification.

But with that, the verification code can be shown in the list of the emails. What are some other security risks here?

Real-life attack scenario: I am on a screen share call with my Boss, I know he intentionally enabled email push notifications on Desktop. I know the service he is using exposes the password reset verification code in the subject of the email. I try to reset there password via email. They receive a notification showing the 6 digit code. I quickly do what's currently going on your mind and 💥

Answer 1

Yes, this is a risk. You shouldn't send it in the subject of the email.

Think of a locked phone but you receive an email with the subject "Your code is 123456-789". That would appear on your phone's lock screen so an attacker can easily see the code (just an example here).