What should I do if someone signs up for an account using my email address?

Question

People periodically sign up for various sites with my email address, both US and internationally.

Would it cause legal problems if I used the "forgot my password" option to reset the password and log into the account?

I don't want to (not actually evil), but when a site doesn't send a confirmation link to verify the email and contacting customer service doesn't fix the problem, there isn't much else I can do.

I've actually had one site tell me: "we cannot change the email address without authorization from the user". That's one of the cases when I reset the password and just changed the email address to that site's customer service email.

Answer 1

In terms of any laws you might be breaking, it is difficult to determine because:

• If the account is associated with your email address, then it appears to be your account and the person who created it would have difficulty proving otherwise.
• You, the person who created the account, your email provider and the website in question might all be in different jurisdictions.
• It all depends rather heavily on the terms of service of any webservice involved.
• Any, if not all, of the service providers may simply refuse to co-operate on such a strange case.

Note, however, that you would probably not face any legal consequences as it is the other person who misused your email address (might even be considered a form of harassment if they target you consistently). They arguably also do not care about the account as they did not bother to ensure that they used their correct email address. If the account is important then they should take pains to correct the situation as soon as they are aware of it. You have already attempted to notify the parties involved (more than what most people would do, which is to click "unsubscribe" or "mark as spam"). At this point, changing the email address is something that seems reasonable.

There is one case, however, where I can imagine people getting really excited about it, and that is if money is involved. If you make someone unable to access their money then they might choose to try and do something about it. I doubt they would be successful, however:

• As it is entirely their fault.
• They're lucky you're the scrupulous type who doesn't just steal it, I hope.
• Simply tracking you down by your email address (in order to sue you) can be extremely difficult, to guaranteed impossible. ( Depends on your email provider. For impossible, think Protonmail or Ghostmail(Corporate only these days, I'm afraid). )
• You have sensibly notified the customer service of the webservice via email (can be shown) prior to doing anything, and they did nothing.

Of course, I am not a lawyer, and if you have any reason to suspect some sort of legal retaliation then you may wish to consult with one.

Answer 2

First, common sense: you find a set of keys on the street, it has a tag on it with the address. You go there, walk in, drop the keys and leave. Would you like someone who finds your keys do this?

Let's say I purchased sex toy from a crappy website and during the checkout process I create an account because the site pushes me to do it. However, I make a typo in the email address. Now you have access to the account and acting in good faith you log in to change my password and greeted by the message "Good news X, your Big Bad Toy has shipped to Address!". Would you want this to happen?

Your intentions might be good but the road to hell is paved with good intentions.

Oh, you are more curious about legal? That is very easy because the relevant US law, 18 U.S.C. § 1030 better known as CFAA is incredibly outdated and is much wider than should be. So:

Whoever— (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (C) information from any protected computer;

Did I authorize you at all? No? Well, there you have it.