Business Tip: Verify Email Addresses

Whenever I log into the website for the national-chain drugstore at the corner, I am greeted by “Welcome back, Annette!” My name is not Annette.

“Annette” used my email address to register on the website long before I ever started using them, long before the branch opened up on my corner. Since I like to think the best of people, I assume that she wasn’t actually trying to make me miserable. Probably, she was just trying to avoid getting years of Special Offers Just For You! spam when all she wanted to do was print a photo or something. She may not even have realized that the email address she was using belonged to someone. She may not be named Annette. She may not be a she (in the profile, she listed herself as male).

The drugstore chain doesn’t verify email addresses before setting up accounts, so there was nothing stopping “Annette” from using someone else’s email address. My email provider has some pretty good spam filters, so I didn’t even realize that someone else had used my address until I tried to sign up myself. Then, it was a trivial matter to click on the “forgot your password?” link to switch the account over to me. Indeed, it wasn’t until I had reset the password that I realized I hadn’t set it up originally and then just forgot about it.

Mostly, this is a minor irritation. I don’t care if the drugstore on the corner calls me “Annette” on its website. Which is a good thing, because while I can change everything else on the account profile, I can’t change the name.

But I’m getting tired of having to locate my pill bottles and type in the numbers in order to refill my prescriptions. I’d really like to get them on my account, so that I can just click on them to get them refilled. I can’t do that, because the website insists that I verify my identity before it will add prescriptions. It’s a sensible precaution for controlled substances– I don’t fault the drugstore for demanding that I verify my identity. However, the only identity that it will let me verify is Annette. Customer Service is spectacularly unhelpful– they’ve informed me that only the account holder can change the information, and that I’ll have to have Annette do it. I cannot get through to them that I am Annette.

There are stupid games I can play, of course. I can use a dummy email address. I can transfer “Annette’s” account to a dummy email address and then sign up as myself with my newly-freed-up real email address. But it seriously, seriously irks me that I have to play stupid games to get around something simple. It irks me enough that I’ll probably take a fair amount of my non-prescription drugstore purchases to a different store, because I dislike patronizing companies that force me to play stupid games to get around something simple.

I don’t blame “Annette”, though. I blame the people who set the website policies, because those are the people who decided to use email addresses as a method of securing the site, but also decided that it wasn’t necessary to verify those email addresses before using them. Those people are everywhere; I’ve gotten receipts from a well-known DVD rental company for movies I didn’t rent in places I’ve never been, using credit cards with last-4-digits that don’t match any of my cards (either that person travels a lot, or multiple people use my email address as their dummy account for that company, because those locations are all over the place). I’ve gotten receipts from online stores for things I didn’t order, shipped to places I don’t live, again using cards with different last-4-digits than mine. Those are just the things that make it past the spam filters– I’ve no idea how many more things get sent to me that I never see. I’ve set up accounts on dozens of websites that didn’t require me to verify my email, too– it’s just luck that I got there first, I suppose.

For every single one of those companies that someone else got to first, I have boycotted making purchases from them. It’s not a question of security, or privacy. It’s that it irks me that those companies made the decision to let someone else steal my email address without even consulting me on the matter. Even with the corner drugstore (which would be inconvenient to boycott for my prescriptions), I take my non-prescription purchases elsewhere.

If you run a website that collects email addresses and uses them without verification, you should be aware that what you are really doing is giving other people the ability to piss off your customers in your name. If your marketing department did that, you’d fire the lot of them. Don’t let your IT department get away with it.