# Account linking security concerns

**URL:** <https://community.auth0.com/t/account-linking-security-concerns/162199>\
**Category:** Get Help\
**Tags:** account-linking, user-management\
**Created:** [December 13, 2024, 10:24am UTC](https://community.auth0.com/t/account-linking-security-concerns/162199 "2024-12-13T10:24:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vitaliip](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vitaliip/32/60008_2.png) [@vitaliip](https://community.auth0.com/u/vitaliip)\
**Post date:** [December 13, 2024, 10:24am UTC](https://community.auth0.com/t/account-linking-security-concerns/162199/1 "2024-12-13T10:24:06Z")

</div>

According to the official documentation on [precautions](https://auth0.com/docs/manage-users/user-accounts/user-account-linking#precautions) and the [example account linking with actions](https://auth0.com/docs/manage-users/user-accounts/user-account-linking/link-user-accounts#example-account-linking-with-actions), when linking accounts using an external custom application, I should ask the user to authenticate with another identity to ensure they own both accounts.

However, what should I do if a user logs in with a new identity (e.g., Facebook) and I find another account with the same email that already includes two linked identities: the primary identity being login/password and the secondary identity being Google? I want to link this new Facebook identity under the login/password identity (to have one account with login/password primary identity and two secondary identities Google and Facebook ). Should I ask the user to authenticate with both the login/password and Google identities to verify ownership, or is it sufficient to require authentication only for the login/password identity, since the login/password and Google identities have already been linked in the past?

---

<div class="post-metadata">

**Author:** ![dawid.matuszczyk](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dawid.matuszczyk/32/74550_2.png) [@dawid.matuszczyk](https://community.auth0.com/u/dawid.matuszczyk)\
**Post date:** [December 16, 2024, 2:51pm UTC](https://community.auth0.com/t/account-linking-security-concerns/162199/3 "2024-12-16T14:51:52Z")

</div>

Hi @vitaliip

Welcome to the Auth0 Community!

Thank you for posting your question. There’s no need to verify the identity of the other factor as the Google factor was already linked between email/password and Google. If your user properly verifies their identity in the primary account (email/password), you can link with the Facebook identity.

Thanks  
Dawid

---

<div class="post-metadata">

**Author:** ![vitaliip](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/vitaliip/32/60008_2.png) [@vitaliip](https://community.auth0.com/u/vitaliip)\
**Post date:** [December 17, 2024, 8:11am UTC](https://community.auth0.com/t/account-linking-security-concerns/162199/4 "2024-12-17T08:11:41Z")

</div>

Hi @dawid.matuszczyk

Got it! Your explanation clarified everything. Thanks for the help!

Best regards,  
Vitalii

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [December 31, 2024, 8:11am UTC](https://community.auth0.com/t/account-linking-security-concerns/162199/5 "2024-12-31T08:11:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.