Your change of email address changing procedure is backwards.
When I changed my email address with Yuku, a verification notification was sent to my new email address.
For the sake of security and to prevent Yuku accounts being hijacked, a verification should be sent to the OLD email address, not the new one.
The way you have it set up now, someone who gets into a user's account could hijack the account and send it to their email address, rather than the user's email address.
Just about every other service that I have interacted with has sent me a "did you request to change your email address" or similar message to my OLD address, not to my new one. This ensures that I made the change, not some third party.
Please fix this.
When I changed my email address with Yuku, a verification notification was sent to my new email address.
For the sake of security and to prevent Yuku accounts being hijacked, a verification should be sent to the OLD email address, not the new one.
The way you have it set up now, someone who gets into a user's account could hijack the account and send it to their email address, rather than the user's email address.
Just about every other service that I have interacted with has sent me a "did you request to change your email address" or similar message to my OLD address, not to my new one. This ensures that I made the change, not some third party.
Please fix this.
