My website allows medical professionals to sign up for an account. After they sign up and provide basic information about their credentials and their practice, we tell them that we need to manually verify their credentials before their account is activated.

My question is: What do I tell the user if he or she tries to log in before we've enabled the account?

My inclination is to politely tell the user that their account has not yet been enabled after they've successfully logged in (via username + password + MFA).

Is there a security problem with this scenario? It seems to me that this is no different than most MFA implementations, which ask for the additional factor after the user has successfully entered a valid username/password combination. In both cases, the user knows that the username/password combination worked because the "next thing" happened.

1 Answer 1


Yes if they have authenticated then letting them know the account is disabled at the moment is appropriate. I like to add a link to resend the email verification as a convenience to the user, if you are using email verification in your provisioning.

  • It sounds like they are doing some manual verification, not email verification. But otherwise, I agree.
    – hft
    Mar 11 at 3:57
  • 1
    Thanks good point. I clarified my answer. Mar 11 at 4:01
  • 1
    Part of the reason I asked this question is because of the way Microsoft's ASP.Net template works. If the account is locked for some reason, the template just denies the login with a generic message rather than telling the user why the account is locked (e.g. lack of payment, violation of Terms of Service, not yet enabled, etc.) Mar 12 at 0:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.