Option to manually approve email changes (spammers)

[doublespaces]

A tactic I've seen spammers use is to register with a well known domain like outlook/Gmail and then change their email to some custom domain and presumably that leaves the old email available for registering a new account.

First, I don't know if that should even be allowed because that would mean people are creating multiple accounts.

Second, it would be helpful if the spam cleaner and registration blocks would detect accounts by their historically shared values.

Third, at a minimum I think the option to manually review all email address changes for certain groups would be beneficial.

 

[Alpha1]

It would be better to check automatically new email account changes to SFS and CleanTalk and if there is a hit, lock/moderate the account.
Maybe @Xon is interested to add this to his signup abuse account. Then it could also be checked against disallowed domains. @UserCheck @DragonByte Tech Maybe validate such email addresses.

 

[doublespaces]

I prefer something light weight (obviously official if possible). The days of playing addon update circus are behind me.

 

[Alpha1]

xenforo has SFS integration by default. Sending all email changes to the approval queue does not seem lightweight to me. We get way to many entries in the approval queue already and dont need legitimate email changes to come up there. And also is a privacy issue. GDPR. But accounts that change to a email address that is in one of the publicly available blacklists, should go to the approval queue as that is likely spammer activity.

Good catch btw. This is a vulnerability that spammers can exploit and the possibility should be closed one way or another.

 

[doublespaces]

We don't have to store their historical emails, it could be a one way hash.

 

[Alpha1]

Email history is already stored in account change history.

 

[doublespaces]

Then I'm not sure what you mean by gdpr issues.
Regardless, it wouldn't be too difficult to have conditions for the change appearing in the approval queue. Instead of just if it's suspicious, also if it's less than X days old etc. Only a very small subset of legitimate email changes would be doing so on the same day or very soon afterward.

 

[MaximilianKohler]

I have requested something similar:
A notification/alert or new mod queue item for changes to a user's profile. There could be options to select email, URL, About, signature, etc.

Spammers use all of these fields. Right now there are only addons that list changes to the fields, so you have to occasionally look through the lists and ban the spammers.

 

[KaraBulut]

xenforo has SFS integration by default. Sending all email changes to the approval queue does not seem lightweight to me. We get way to many entries in the approval queue already and dont need legitimate email changes to come up there. And also is a privacy issue. GDPR. But accounts that change to a email address that is in one of the publicly available blacklists, should go to the approval queue as that is likely spammer activity.

Good catch btw. This is a vulnerability that spammers can exploit and the possibility should be closed one way or another.

The SFS checking is only on registration, correct? If the registration email is valid, then confirmed and once confirmed, the user changes to a disposable email or an invalid email domain, the subsequent email addresses aren't validated.

I have seen this pattern with spammers- they will start with a Gmail address and then switch to 10minutemail. We would reject the 10minutemail if used on registration but there is no checking after registration, so the change to 10minutemail would not be flagged. Once they confirm the 10minutemail change, they're able to post again.

The simplest solution is to validate all email changes against SFS or to have a setting for a time window when email changes get routed to a moderator queue (e.g. if they change within 72 hours from registration, flag the change). If the moderator wants to validate every change, the window setting could be set to a fixed value like 0 or 999.

 

[Digital Doctor]

The simplest solution is to validate all email changes against SFS or

Nice.

to have a setting for a time window when email changes get routed to a moderator queue (e.g. if they change within 72 hours from registration, flag the change). If the moderator wants to validate every change, the window setting could be set to a fixed value like 0 or 999.

Nice.

Should be core.
Should not be hard to implement.

 

[Eggy]

Eggy Email Change Approval

Aug 12, 2026

Require staff approval before members can change their account email address.

• Eggy
• account security admin approval email approval email change moderation security user accounts user management
• Add-ons [2.x]

 

[woody]

[XB] User Profile Edit Notify

Feb 13, 2025

Get notified when users update their profile fields

• Painbaker
• Add-ons [2.x]

This has worked for me for years. IMO, alerting the Admin is a better option than requiring those changes be approved.

 

[Dragonfruit]

Another option: https://xenforo.com/community/resources/ozzmodz-email-whitelist.7951/

Create a list of allowed email domains only, custom ones won’t work.