We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also allows users to change their email address after verification (with a re-type email field, as well).
What are the pros and cons of having the user re-verify their email. Is this even needed?
Summary of answers and comments below:
- "Over-verification" annoys people, so don't use it unless critical
- Consider a "re-type email" field to prevent typos, but users can still copy/paste, rendering it moot.
- Beware of overwriting known good data with potentially good data
- Send email to old for notification; to new for verification
- Don't assume that the user still has access to the old email
- Identify impact of incorrect email if account is compromised