The address of record: where the operator is entitled to write
An operator writes to the address it holds, and the terms usually say so explicitly. That makes the address of record the single most consequential setting on the account, and changing it is the moment a message can go somewhere the reader no longer looks.
- addresses
- 2
- change takes
- 24 h
- messages a day
- 1.67
- caught by the window
- 1.7
An account carries at least two addresses of record - an email address and a telephone number - and the terms treat the ones held at the time of sending as correct. On the samples a change takes twenty-four hours to take effect, so a message sent inside that window goes to the old address: about 1.7 messages on average, 0.4 of them marketing.
Two addresses, two jobs
The email address is the channel that carries documents and evidence; the telephone number is the channel that carries short, urgent messages. They are separate settings, and changing one does not change the other, which is why a reader who changes a number and keeps an old inbox keeps receiving receipts there.
| Address | Messages | Carries | Evidences arrival | Change takes |
|---|---|---|---|---|
| 33 | receipts, offers, notes, alerts and notices | yes | 24 h | |
| telephone number | 2 | short alerts and one-time codes | yes | 24 h |
| two addresses | 35 of 50 | the other 15 travel to the in-app inbox, push or post | - | - |
Why the change is a security event
An address of record is also the way a password reset reaches a reader, so a change to it is the step an attacker wants most. That is why the change takes a day rather than a moment, and why the notice of the change is itself one of the five kinds.
What to do with the address of record
The setting is worth ten minutes, because almost every later argument about "I was never told" resolves into a question about which address the operator held.
- Keep the email address on the account one you actually read, and one the operator has evidenced a message to.
- Change one address at a time, so a receipt you did not expect identifies the one that was changed.
- Expect the change to take about a day, and expect the messages inside that day to go to the old address.
- Treat the notification of a change you did not make as the moment to check sessions and payout methods, not the moment to reply.
- Keep the receipt for the change itself: it dates the point at which later messages had a new destination.