How email verification can help you confirm identities and prevent fraud

Email verification can help keep your business safe by uncovering suspicious activity. Learn what email verification is and how it can help you.

An icon of a person surrounded by circles of emails
Last updated:
Read time:
Share this post
Table of contents
⚡ Key takeaways
  • Email addresses are an indirect piece of personally identifiable information (PII) and play a role in identity verification (IDV) and fraud prevention.
  • The three main ways to verify emails are sending a one-time password to the email, checking an email’s reputation using an email risk report, and verifying email ownership using external databases.

Anyone can create a new email address in minutes. They generally don’t have to verify their identity or use their real personal information, and they can go on to use the email address to try to open other accounts. In a sense, an email address can be rather impersonal. 

Except, legitimate email addresses tend to actually be deeply personal. There’s a good chance you’ve had an email address for years — maybe decades — and it’s a foundational connection that ties you to different platforms, services, and purchases you’ve used or made over time. 

The dichotomy is a good thing. It means you can use positive and negative signals associated with email addresses, along with several types of email verification, to detect bad actors during account opening, before confirming a transaction, and at other points throughout the customer lifecycle. 

The three types of email verifications

An email address can be an indirect piece of personally identifiable information (PII) and play a role in identity verification (IDV) and fraud prevention. For these purposes, there are three types of email verification you can use on their own or in combination:

  • Access to the email: Can the person access the email address?
  • The email’s reputation: Is the email address reputable? 
  • Email ownership: Does the email address belong to the person? 

1. Access to the email 

  • You can confirm this by sending a one-time password (OTP) to the email.

Access to an email account doesn’t prove identity on its own. A bad actor may have access to someone else’s email account. Multiple members of an organization, family, or friend group might share a single email address. However, access can still be important. 

For example, you might use an OTP to have someone prove that they can access an email address when they’re creating a new account. The check can help you detect bad actors who have other information associated with an email — such as a first and last name — but don’t know the account password. 

You can also trigger an OTP request when you notice unusual activity such as an attempt to place a high-value order or change an account’s contact information. The OTP might act as a low-friction safety check that prevents some fraudulent transactions and account takeovers.  

2. The email’s reputation

  • Check an email’s reputation using an email risk report.

Different signals can help you determine the risk associated with an email address, and vendors may offer email risk reports or scores that you can integrate into your processes. Some signals are firmly positive or negative, such as whether the email address is on a fraud list. Others may range depending on the results. 

Commonly used data points are:

  • First seen: The date that the email address was first seen, which might correspond with an account opening, social media post, data breach, or other incident. Generally, a brand-new email address is riskier than an old one. 
  • Last seen: When the email address was most recently seen. Bad actors might create or buy aged email addresses, and if the address hasn't been seen since the “first seen” date, that could be a red flag. 
  • Velocity: How frequently the email address is used, generally with a focus on recent activity. 
  • Blocklists: Whether the email address or domain is part of any blocklists, such as denylists, scam lists, or fraud lists. 
  • Free or disposable: Whether the address is from a free or temporary email service.
  • Spam: Whether the email exhibited spammy behavior. 
  • Deliverability: Whether the address is valid and can receive emails. 
  • Valid MX: If the email server has a valid mail exchange (MX) record, which tells you where the email server is for sending and receiving emails. 
  • Domain age: When the domain (the part after the @) was created. 

You might also be able to determine riskiness by analyzing the elements of the email address, such as its length, the letters and numbers in the address, and whether it’s a variation of a blocklisted email. 

Different services may also include other information or data points. For example, Persona’s email risk report gives you a value for email address and domain reputation (e.g., high or low reputation), and suggests whether you should treat it as suspicious or risky. 

3. Email ownership

  • Verify email ownership using external databases.

Perhaps you’ve confirmed that someone has access to an email account and the email address doesn’t appear risky. You still may want to take an additional step to confirm that the person you’re interacting with is the email’s owner. 

To do this, you can try to connect other PII that you’ve collected, such as their name or phone number, to the email using external databases. These could be authoritative databases, such as credit bureaus and financial institutions, along with commercial and marketing databases.

Benefits of email verification for identity and fraud

Email checks and verifications offer several key benefits:

  • Low friction: The reputational and ownership checks are passive signals. Legitimate users will also likely be on a mobile device or computer that they can use to quickly verify that they have access to their email. 
  • Enhances fraud prevention: The email and domain risk assessments can help give you a more complete picture of your users. You can run new checks if someone tries to change their account’s email address and automate periodic account reviews to try to identify bad actors based on updated email reputation verifications and link analysis
  • Improve trust: While asking users to confirm via an OTP adds a small amount of friction, people are increasingly familiar with these types of requests. Legitimate users might even see an OTP as a sign of safety and trust, especially when it’s triggered by a large transaction or account change. 
Free white paper
See how experts evaluate verification solutions

Common drawbacks of email verification

Email verification isn’t a catch-all, and there are some drawbacks to be aware of: 

  • Email coverage is low: Authoritative databases that you can use to verify other types of PII don’t necessarily contain or share consumer email addresses. 
  • Marketing data isn’t always verified: Marketing agencies often aggregate email data, but they don’t necessarily verify the owner’s identity. 

Email addresses for uncovering fraud

From detecting bad actors at onboarding to authenticating existing users, verifying an email address and its owner can be helpful throughout the customer lifecycle. But you can also use an email address as an identifying element within a fraud-discovery tool, such as Persona’s Graph

You can use link analysis to find and understand how data points are connected, including names, emails, and IP addresses. One bad actor could be the key to uncovering a fraud ring focused on promo abuse or account takeovers. You can block accounts right from Graph and automate detection of similar suspicious patterns. One of our customers, nWay, found that about 50% of fraudulent accounts are linked to at least one other risky account. 

Schedule a demo to learn more about how email risk reports and fraud-discovery tools can benefit your identity verification process and help you stop fraud. 

Published on:

Frequently asked questions

How does email verification work?

There are several email verifications that can be used for confirmation. Often, a one-time password (OTP) will be sent to an email to confirm possession or access to the account. Email risk reports or scores can confirm whether the email is reputable. Looking for the email and associated personal information in existing databases can help confirm the owner’s identity. 

Can email verification confirm someone's identity?

Email verification can be a helpful part of identity verification and authentication, but it doesn’t verify someone’s identity on its own. You may find it to be a suitable substitute for more robust identity verification in certain circumstances, or as an additional low-friction option. 

Does email verification prevent fraud?

An email verification check might be able to prevent certain types of fraud. For instance, you could detect and stop bad actors who are trying to open new accounts if their email addresses aren’t reputable. Or, you might be able to stop someone from taking over an account if they can’t verify access to the associated email address. 

Continue reading

Continue reading

From fraud to fairness: Leveraging KYC and age verification for online gaming
From fraud to fairness: Leveraging KYC and age verification for online gaming

From fraud to fairness: Leveraging KYC and age verification for online gaming

KYC can help keep online gamers of all ages safe and reduce fraud. Learn how KYC and age verification can benefit your gaming platform.

How to fight ID fraud in a world of generative AI
How to fight ID fraud in a world of generative AI

How to fight ID fraud in a world of generative AI

Learn how generative AI is changing the game when it comes to fake IDs and what you should be mindful of when enhancing your fraud strategy.

What is remote KYB onboarding?
What is remote KYB onboarding?

What is remote KYB onboarding?

Remote Know Your Business (KYB) technology efficiently onboards business customers. Learn more about how digital onboarding addresses changing regulations.

What is address verification?

What is address verification?

Address verification can help confirm if a person or business is based at the address they provided.

What are issuing database verifications?

What are issuing database verifications?

Issuing database verifications are one of the best ways to reduce fraud in your business. Learn more.

What is government ID verification?

What is government ID verification?

Learn how government ID verification works, how it's evolving, and more.

Ready to get started?

Get in touch or start exploring Persona today.