> (Companies should really validate email address OWNERSHIP before spamming innocent people.)

I don't understand why this isn't part of the normal flow for implementing Verify Your Email emails.

Someone used my firstname.lastname Gmail address on trip dot com a couple of days ago to book flights, and their Verify Your Email email actually had a Not My Email-type link in it... which apparently does nothing, as I shouldn't know that if you phone trip dot com about changing your flights, they send you an email with a Change Flight link.

I just got off a chat with their support, so hopefully my fat-fingered doppelganger doesn't miss their flights from Atlanta to Sydney tomorrow.

Now that I think about it, I don't think I've ever seen an email verification flow that works in reverse, where the email owner sends the email instead. Seems it would be easy enough to say "Send an email from your indicated account with <pin> to <corporate email address>." I'm assuming the flow is different enough that it would lead to losing people who decide not to follow through but who would have continued with the 'normal' setup. It would also train users to send their MFA pins to others which would be a net negative for anyone using the normal verification process.

Are you sure they were confused people? More probable explanation is that they made typos while entering their email.

The alternative explanation, that they roitinely use [your name].[your last name]@gmail.com as their email, and don't realize that it never works is... unlikely IMO.

One of the emails had a phone number for the intended recipient, so I called. It was an old person who was definitely confused.

I can easily imagine there are a bunch of older people who do not have email addresses, yet just about everything requires an email address, even if it's not necessary for whatever service, so people have to either make up an address, or incorrectly remember what the address was that their children or grandchildren set up for them.

Either way, that doesn't excuse the companies that spam innocent people.

My wife has been receiving medical appointments, test results, event tickets, package tracking numbers and so on destined to a few old ladies for years. I once tracked the sons and nephews of one and told them, and they apparently thought I was some kind of scammer and didn't return messages after a couple exchanges, so to this day she still receives all those.

If the email they were trying to reach was [firstname].[middle initial].[lastname] and they forgot the middle initial that would explain why it's showing up in your inbox.