ASVS V6.3.7 requires that users are notified after updates to authentication details, such as credential resets or a change of username or email address. It is a Level 3 requirement.
The pattern is the same as a bank alert: the account holder hears about a sensitive change right away, through a channel that does not depend on the new value.
Why it matters
Takeover attackers change the email or password immediately so the real owner cannot recover. A prompt notice, especially to the previous address, gives the owner a short window to act.
A takeover usually ends with a change of email or password so that the real owner cannot recover the account. The window between the change and the owner noticing decides how much damage is done. A notice sent to the previous address gives the owner that early warning, and a short delay or undo link can turn it into a real defense.
How to implement it
Send the message from the code path that performs the change, not from the UI. On an email change, notify the old address as well as the new one.
def update_email(user, new_email):
old = user.email
user.email = new_email
user.save()
send(old, "Your account email was changed", "If this wasn't you, reset access now: <support link>")
send(new_email, "Email address confirmed for your account", "You will receive notices here.")
audit_log("email_changed", user.id)
Do not include secrets in the message. Include the time, an approximate location or device and a recovery action. Cover password change, reset, MFA enrolment or removal and username updates.
Hook the notification into the domain event, not the controller. Trigger it for password changes and resets, username changes, email changes, MFA enrolment, MFA removal, recovery code regeneration and the addition of new passkeys. Include what changed, when, the approximate location or device, and how to lock the account. Rate limit the messages to avoid being used as a spam channel, and write each one to the audit log with the notification result.
How to test it
Perform each change in a test account and check the inbox for a single message per change. Confirm the old address received the email change notice.
Common mistakes
-
Notifying only the new address.
-
Sending the notice only from the web form, missing API changes.
-
Including a reset link that works without verifying the owner.
-
Sending the notice after the old address has already been replaced, so it goes to the attacker.
-
Using generic wording that hides which attribute changed.
Quick check
Who should be told about an email change?
Both the old and new address. The old one reaches the real owner if the change was malicious.
