Let's suppose I have an email account: user@example.com. Then, some other user signs up on a third-party service with email-based login with my email address (by mistake or not) and then I receive a confirmation email to activate that account on my inbox. I'd like to ask the following:

  1. Is it legal for me to follow the account-verification link and delete that account?
  2. Is it also legal to ask for an account recovery process and do the same thing: delete the account?
  3. Does the answer depend on parts' jurisdiction/location?
  • 2
    What jurisdiction are you under? What jurisdiction is the 3rd-party-service under? – Polygnome Aug 20 '20 at 13:01
  • What happens if you don't activate the account? – ItWasLikeThatWhenIGotHere Aug 20 '20 at 15:16
  • 2
    A further thought - do you know for certain the e-mail is from a legitimate service? Does the domain when you hover over the link match the domain of the service? It's worth considering that this may be an attempt at Phishing. – ItWasLikeThatWhenIGotHere Aug 20 '20 at 15:19
  • Thanks @Polygnome for pointing that! – Pestro Aug 21 '20 at 15:30
  • @ItWasLikeThatWhenIGotHere, on my question I assume it's not phishing – Pestro Aug 21 '20 at 15:31

Let's assume that this is in the US (different countries have different laws but most countries have some version of these protections). The Computer Fraud and Abuse Act prohibits unauthorized access. You would be concerned with 18 USC 1030(a)(2) which punishes a person who

intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains...(C) information from any protected computer.

You might think that since it has your email, you are "authorized", but actually only the account-holder is so authorized, and exceeding authrized access

means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter

For example, deleting the account. You can ask for recovery links and delete an account only if it is your account. An account that is erroneously associated with your email address is still not your account, and you have no authorization to access an account that is not your account and where the account owner has not permitted (authorized) you to access the account for some purpose. It's a felony.

  • 1
    Just a comment: it seems the world upside down, somebody uses another's identity to sign up for a service and it's the latter who must be careful not to be a criminal. – Pestro Aug 21 '20 at 15:37
  • 1
    not activating the account usually deletes the account after a few days, so inaction actually is safe. – Trish Sep 20 '20 at 23:36
  • @Pestro, it's not clear to me what you find unjust here. All the law requires you to do is do nothing. – Tiger Guy May 19 at 5:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.