I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes:

  • First name
  • Last name
  • E-mail address
  • Password

To be more elaborate, should the old or new email be used to send the account update notification? What information that was changed should be sent in the e-mail (ie: name, e-mail, password)? Is it necessary to have a activation e-mail sent if the e-mail address is changed? I should also note that the e-mail address is being used as the username.

  • Why you insist on email as the very right means of alerting user? I mean If I'm the one who hacked your user account I will never change your user-name or password or anything of that sort. Its not enough to just detect account changes but also alert on suspicious account usage (like access via different country ip)
    – Saladin
    Apr 27, 2013 at 18:55

1 Answer 1


You should always assume that registration information is what your real user wants, any later change and the user should be notified, especially when it comes to critical information such as username and password.

  • When the email address is changed, an confirmation email should be sent to the new address containing a link to activate the new email address. A notification email should be sent to the old address as well (containing a link to revoke/report this change).

  • When the password is changed, a notification email should be sent to the current email address containing a link to report/revoke the change.

  • First name and last name are a special case. They're non-critical information, but they're unlikely to change very often. So I'd say go with what best suits your application.

  • Other information such as age, about me, likes, sports, hobbies, etc... are clearly non-critical information. Personally, I'd like to have the option to be notified about them, so it's nice to have an opt-in checkbox for that.

  • Wouldn't it be better to send a confirmation email to the old address?
    – user10211
    Apr 27, 2013 at 7:12
  • What to do in case of old e-mail account being compromised? Apr 27, 2013 at 7:13
  • @TerryChia Well in that case two confirmation emails should be sent, I don't think asking the user to click two links is a great user experience. It's enough to allow the user to revoke this change from his old address (presumably his genuine address)
    – Adi
    Apr 27, 2013 at 7:15
  • 1
    @DeerHunter Nothing. This how this works, your account is linked to that email address. The user's mobile can be compromised and the activation codes could be used, the user's machine could be compromised with a keylogger. I don't see how that could be the problem of your application. Of course, normal recovery steps could be taken (the same ones used by Facebook for example).
    – Adi
    Apr 27, 2013 at 7:19
  • @DeerHunter Also, I don't see how this relates to the question. If the attacker has control over the account, the old email, and the new email (chosen by the attacker) then it's a whole different story.
    – Adi
    Apr 27, 2013 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .