Share account details only with the account's verified contact

How to do it

Anyone can write "I am the owner, send me my invoices". Sending account data to the wrong person is a personal data breach. Match an email sender to the verified address on the account. When it differs, reply to the address on file instead, and say nothing about the account to the new one. On the phone, ask the caller to read out a one-time code from their signed-in app. Never confirm that an account exists for an address. Changes to sign-in details follow Check who is asking before support changes an account, which this rule does not repeat.

Examples

JavaScript example

export function replyAddressFor(ticket, account) {
  const senderIsVerified = account.verifiedEmails.includes(ticket.fromAddress.toLowerCase());
  return senderIsVerified ? ticket.fromAddress : account.primaryEmail;
}

export const mayShowAccountDetails = (ticket) =>
  ticket.channel === 'signed-in-chat' || ticket.verification === 'app-code' || ticket.verification === 'verified-email';

Python example

def reply_address_for(ticket, account) -> str:
    sender_is_verified = ticket.from_address.lower() in account.verified_emails
    return ticket.from_address if sender_is_verified else account.primary_email

def may_show_account_details(ticket) -> bool:
    return ticket.channel == "signed-in-chat" or ticket.verification in {"app-code", "verified-email"}

How to check

Write to support from an address that is not on a test account and ask for its invoices. The reply goes to the address on file, and the stranger's address gets no account data. A test of the support tool shows the sender's verification state on every ticket.

Sources

• GDPR Articles 5(1)(f) and 32 on security of processing
• OWASP Authentication Cheat Sheet on help desk staff

Related rules

• ACC-50 Check who is asking before support changes an account in Accounts and identity
• SUP-33 Verify data requests with the sign-in instead of ID copies in Customer support