Improve Messaging for Unauthorized Portal Users During Login
complete
A
Ami Depierro
When a user enters an email address that is not configured as a Portal User, the current experience appears to prompt for a verification code that is never received. This creates the impression that email delivery or the portal is malfunctioning.
Consider displaying a message such as:
"This email address is not an authorized Portal User. Please contact an existing Portal User or your MSP to grant access, or use Guest Checkout."
Many SMBs have invoices forwarded between owners, office managers, bookkeepers, controllers, and AP staff. Most users are unaware that an existing Portal User can add additional users. Providing a clearer message and directing users to the Portal User process would reduce confusion, failed login attempts, and support requests.
A
Ami Depierro
thank you for letting me know
S
Sam Kushner
updated the status to
complete
S
Sam Kushner
Hi Ami Depierro,
I understand the frustration, but we can't show a message that reveals whether an email address is an authorized Portal User.
If the portal responds differently for known and unknown addresses, anyone can type in a list of emails and learn which ones have billing access at a company. That gives bad actors and attackers a confirmed target list for phishing, fraud, and other malicious attacks. The generic "a code has been sent" response exists so that outsiders learn nothing from probing the login form. This is a standard security practice, and it's the same reason password reset forms never confirm whether an account exists.