People periodically sign up for various sites with my email address, both US and internationally.

Would it cause legal problems if I used the "forgot my password" option to reset the password and log into the account?

I don't want to (not actually evil), but when a site doesn't send a confirmation link to verify the email and contacting customer service doesn't fix the problem, there isn't much else I can do.

I've actually had one site tell me: "we cannot change the email address without authorization from the user". That's one of the cases when I reset the password and just changed the email address to that site's customer service email.

  • I had a woman give one of my email addresses for a job site and her son's school. When I received her son's grade card, I emailed the school so they could contact her. I don't remember what I did about the job board. I think I did change the password so she would be forced to do something.
    – mkennedy
    Commented Dec 25, 2015 at 0:42
  • Why is this happening? Do you have an email address that is so simple people people tend to put it in just to get past some form validation?
    – user2497
    Commented Jul 8, 2016 at 22:53

2 Answers 2


In terms of any laws you might be breaking, it is difficult to determine because:

  • If the account is associated with your email address, then it appears to be your account and the person who created it would have difficulty proving otherwise.
  • You, the person who created the account, your email provider and the website in question might all be in different jurisdictions.
  • It all depends rather heavily on the terms of service of any webservice involved.
  • Any, if not all, of the service providers may simply refuse to co-operate on such a strange case.

Note, however, that you would probably not face any legal consequences as it is the other person who misused your email address (might even be considered a form of harassment if they target you consistently). They arguably also do not care about the account as they did not bother to ensure that they used their correct email address. If the account is important then they should take pains to correct the situation as soon as they are aware of it. You have already attempted to notify the parties involved (more than what most people would do, which is to click "unsubscribe" or "mark as spam"). At this point, changing the email address is something that seems reasonable.

There is one case, however, where I can imagine people getting really excited about it, and that is if money is involved. If you make someone unable to access their money then they might choose to try and do something about it. I doubt they would be successful, however:

  • As it is entirely their fault.
  • They're lucky you're the scrupulous type who doesn't just steal it, I hope.
  • Simply tracking you down by your email address (in order to sue you) can be extremely difficult, to guaranteed impossible. ( Depends on your email provider. For impossible, think Protonmail or Ghostmail(Corporate only these days, I'm afraid). )
  • You have sensibly notified the customer service of the webservice via email (can be shown) prior to doing anything, and they did nothing.

Of course, I am not a lawyer, and if you have any reason to suspect some sort of legal retaliation then you may wish to consult with one.


First, common sense: you find a set of keys on the street, it has a tag on it with the address. You go there, walk in, drop the keys and leave. Would you like someone who finds your keys do this?

Let's say I purchased sex toy from a crappy website and during the checkout process I create an account because the site pushes me to do it. However, I make a typo in the email address. Now you have access to the account and acting in good faith you log in to change my password and greeted by the message "Good news X, your Big Bad Toy has shipped to Address!". Would you want this to happen?

Your intentions might be good but the road to hell is paved with good intentions.

Oh, you are more curious about legal? That is very easy because the relevant US law, 18 U.S.C. § 1030 better known as CFAA is incredibly outdated and is much wider than should be. So:

Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer;

Did I authorize you at all? No? Well, there you have it.

  • Downvotes but no comments? Where am I wrong?
    – chx
    Commented Jul 9, 2016 at 3:09
  • this site is like this - way more then any other stack exchange sites I'm on. I think the points you have made are valid (but would point out that by entering in a false email address - ie mine - the other party arguably breached the CFAA first. (Also, no reason I should have a sex shop spam me with there wares when I did not sign up, and the place accepting email without double-opt-in is behaving badly, and the party representing my address as there's could arguably be committing fraud - even though its petty and technical).
    – davidgo
    Commented Jul 9, 2016 at 9:05
  • Most shops will allow you to finish purchasing without creating an account, creating an account is a sort of afterthought so the verification email will land in the Good Samaritan's inbox instead of the purchaser.
    – chx
    Commented Jul 9, 2016 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .