internet email identity-theft
Delete another user&#39;s account using my email address
<p>Let's suppose I have an email account: <code>user@example.com</code>. Then, some other user signs up on a third-party service with email-based login with <strong>my email address</strong> (by mistake or not) and then I receive a confirmation email to activate that account on my inbox. I'd like to ask the following:</p>
<ol>
<li>Is it legal for me to follow the account-verification link and delete that account?</li>
<li>Is it also legal to ask for an account recovery process and do the same thing: delete the account?</li>
<li>Does the answer depend on parts' jurisdiction/location?</li>
</ol>

<p>Let's assume that this is in the US (different countries have different laws but most countries have some version of these protections). <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">The Computer Fraud and Abuse Act</a> prohibits unauthorized access. You would be concerned with <a href="https://www.law.cornell.edu/uscode/text/18/1030#a_2" rel="nofollow noreferrer">18 USC 1030(a)(2)</a> which punishes a person who</p>
<blockquote>
<p>intentionally accesses a computer without authorization or <a href="https://www.law.cornell.edu/uscode/text/18/1030#e_6" rel="nofollow noreferrer">exceeds
authorized access</a>, and thereby obtains...(C) information from any
protected computer.</p>
</blockquote>
<p>You might think that since it has your email, you are &quot;authorized&quot;, but actually only the account-holder is so authorized, and exceeding authrized access</p>
<blockquote>
<p>means to access a computer with authorization and to use such access
to obtain or alter information in the computer that the accesser is
not entitled so to obtain or alter</p>
</blockquote>
<p>For example, deleting the account. You can ask for recovery links and delete an account only if it is your account. An account that is erroneously associated with your email address is still not your account, and you have no authorization to access an account that is not your account and where the account owner has not permitted (authorized) you to access the account for some purpose. It's a felony.</p>

<p>This answer is meant to supplement <a href="https://law.stackexchange.com/a/55541/3066">the answer by user6726</a> and to follow up to your comment that &quot;<em>it seems the world upside down, somebody uses another's identity to sign up for a service and it's the latter who must be careful not to be a criminal.</em>&quot;</p>
<p>The situation might not seem so unreasonable if we consider the effect of the <a href="https://gdpr-info.eu/" rel="nofollow noreferrer">GDPR</a> (and possibly similar laws elsewhere). The GDPR applies to sites (data &quot;controllers&quot; in the GDPR terminology) which are based in EU member states, the UK (in a slightly modified form known as the UK GDPR), and to controllers outside the EU/UK if the site offers goods/services to data subjects who are in the EU/UK, pursuant to <a href="https://gdpr-info.eu/art-3-gdpr/" rel="nofollow noreferrer">Article 3</a>.</p>
<p>In order to process personal data, the controller must have one of the 6 lawful bases for doing so. The lawful bases are (1) consent, (2) necessity for performance of a contract with the data subject, (3) compliance with a legal obligation, (4) necessity to protect a vital interest of a person, (5) necessity for the public interest or official authority, and (6) necessity for the site's legitimate interests (<a href="https://gdpr-info.eu/art-6-gdpr/" rel="nofollow noreferrer">Article 6</a>).</p>
<p>It should be quite clear that none of those would permit a normal online service to process your personal data in this scenario. They do not have your consent, they are not in a contract with you, and there are no legal obligations, vital interests, public interest, or legitimate interests for keeping that data.</p>
<p>Where a controller has no lawful basis for the data processing, you have the right to erasure. <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Article 17</a> provides:</p>
<blockquote>
<ol>
<li>The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay
and the controller shall have the obligation to erase personal data
without undue delay where one of the following grounds applies: [...]
(d) the personal data have been unlawfully processed;</li>
</ol>
</blockquote>
<p><a href="https://gdpr-info.eu/art-12-gdpr/" rel="nofollow noreferrer">Article 12</a> provides more information on exercising your rights against controllers (including the right to erasure).</p>
<p>So, in your scenario, although you may have no right to access or delete the account which does not belong to you, you may have the right to require your email address to be removed from it. Going back to your comment, this seems quite a reasonable scenario: your rights extend to the aspects which affect you but not to those which do not.</p>
