Email verification: the complete 2026 guide

Historically the #1 objective. By forcing email verification, a site makes automated account creation costly: a bot can generate 10,000 accounts in seconds, but must then manage 10,000 active inboxes to validate them. The cost/benefit ratio makes the attack unprofitable in most cases.

This is also why sites block disposable emails: disposable email is by definition free and unlimited, so doesn't act as a barrier. Services like Akismet, FraudLabs, or Cloudflare maintain blacklists updated hourly.

More insidious: email verification also serves to immediately start direct marketing. Once your real address is captured, you'll receive: welcome email, onboarding series (5 to 12 emails over 2 weeks), feature notifications, sales follow-ups, newsletter, "last chance promo" alerts...

According to a HubSpot study (2024), the average user receives 287 marketing emails per month, 60% from sites where they voluntarily signed up. The mandatory "unsubscribe" button doesn't always work and some sites bypass it with dark patterns.

Some sectors are required to verify email for regulatory reasons: banking (KYC, USA Patriot Act), government (taxes, social security), healthcare (GDPR article 9), gambling. In these cases, bypassing verification = fraud, which is not the subject of this guide.

For these sites, always use your real email, and probably your real name, real date of birth, real proof of address. Disposable email has no place here.

Finally, email verification is used to establish a minimal traceable identity. Combined with your IP, your browser, your mouse behavior (yes, it is tracked), your email forms a "fingerprint" that allows sites to:

• Recognize you across partner sites (advertising cross-referencing)
• Block you if you are blacklisted (payment failure, earlier fraud)
• Personalize your experience (dynamic pricing: yes, the same plane ticket can cost 20% more depending on your profile)
• Resell the identifier to data brokers

To limit these 4 uses, a disposable email is effective for uses 2 and 4 (marketing engagement and resale), partially effective for use 1 (the site can block the domain), and ineffective for use 3 (legal sites do not accept disposable addresses).

The API parses HTML and text content to identify common OTP patterns:

• Numeric codes 4-8 digits (most common: 6 digits)
• Alphanumeric codes 6-10 characters
• Formatted codes XX-XX or XXX-XXX (TikTok, Discord)
• Tokens in magic links (extracted from token= or code= URL parameters)

A scoring heuristic distinguishes OTP from other numbers (reference, date) based on surrounding text context (keywords like "code", "OTP", "verification", "código").

For developers running automated E2E tests with Playwright, Cypress, Puppeteer:

1. Your script creates an account with username@mail123.click
2. Site sends OTP code
3. Your script calls GET /api/v1/messages/{box}
4. Reads the last message's otp_code field
5. Submits the code in the web form
6. Continues E2E test without human intervention

Full workflow under 5 seconds. See API documentation for details.

Netflix, Spotify Premium, Amazon Prime, Steam (purchased games), Adobe Creative Cloud, SaaS subscriptions. If you lose access to the mailbox (forgotten name, emails wiped after 7 days) and you have a payment problem (expired card, bank refusal), you will no longer be able to contact support. Typical consequences:

• Suspended account that cannot be reactivated
• Charges continuing with no way to cancel via self-service
• Lost purchases (Steam games = permanently lost)

Use instead: your real address OR a permanent alias (Apple Hide My Email, SimpleLogin) that never disappears.

Banks (Société Générale, BNP, Boursorama, Revolut, N26), insurance, crowdfunding, online brokers (Trade Republic, eToro), crypto platforms. These services require KYC (Type 8) and never accept a disposable email anyway, but even if it worked, it would be dangerous: losing access to fraud notifications can be costly.

Doctolib, Maiia, telehealth platforms, health insurance, medical tracking apps (glucose, blood pressure, fertility). Data protected by GDPR article 9. Lost access = lost medical history = potentially dangerous.

LinkedIn, Stack Overflow, GitHub (if professional), Slack workspaces, enterprise SaaS tools. Your career depends on the continuity of these accounts. Even though LinkedIn does not accept disposable emails (Type 7), it would be a bad idea even if it did.

Impôts.gouv, FranceConnect, Pôle Emploi, Ameli, social security, Caf, prefecture, Urssaf. These services require your real identity anyway, and losing access can have serious administrative consequences (loss of rights, payment delays, tax adjustments).

The GDPR (article 5.1.c) imposes the principle of data minimization: a service must only collect the data strictly necessary for its purpose. The CNIL has publicly encouraged the use of disposable emails and aliases in its "Maîtriser ses données personnelles" recommendations published in 2023.

Using a disposable email is never a criminal offence. At most it is a breach of a service's Terms of Use, which falls under contract law (maximum sanction: the service deleting the account, never a criminal penalty).

A disposable email becomes legally problematic only in these specific cases:

• Subscription fraud: opening a bank or insurance account with a false identity (the email is only a signal, the offence is the false declaration of identity)
• Tax evasion: creating a company with a fictitious email/identity to avoid taxation
• Cybercrime: phishing, ransomware, harassment, doxxing, where the disposable email is used to hide the author
• Sanctions evasion: for example, creating an account on a service with which you are in a legal dispute

In these 4 cases, it is not the disposable email that is illegal, but the criminal act it helps commit. The mail123 service provides no information or service for this kind of use.

In the USA, the situation is similar with a few specifics: the CAN-SPAM Act (2003) regulates sending advertising emails but does not prohibit users from using disposable emails. COPPA (Children's Online Privacy Protection Act) sets rules for under-13s, and a disposable email can paradoxically help PROTECT minors' privacy.

Main endpoints for E2E tests:

• POST /api/v1/inboxes, create temporary inbox
• GET /api/v1/messages/{{box}}, list received messages
• GET /api/v1/messages/{{box}}/{{id}}, message details with otp_code field
• DELETE /api/v1/inboxes/{{box}}, clean up inbox after test

No auth or API key needed. CORS open. Rate limit: 30 requests/hour per IP.

test('signup with OTP', async ({ page }) => {
  const username = `test-${Date.now()}`;
  const email = `${username}@mail123.click`;

  // Sign-up
  await page.goto('https://example.com/signup');
  await page.fill('[name=email]', email);
  await page.click('button[type=submit]');

  // Retrieving the OTP
  await page.waitForTimeout(3000); // wait for delivery
  const res = await fetch(`https://mail123.click/api/v1/messages/${username}`);
  const messages = await res.json();
  const otp = messages[0].otp_code;

  // Validation
  await page.fill('[name=otp]', otp);
  await page.click('button[type=submit]');
  await expect(page).toHaveURL(/dashboard/);
});

For Cypress / Puppeteer / Selenium, the pattern is identical: create a unique mailbox, wait for delivery, fetch the API, extract the OTP and validate.

To integrate these tests into a CI pipeline (GitHub Actions, GitLab CI, Jenkins):

• No credential management: no API keys, no passwords to store
• No side effects: each test uses a unique mailbox, no pollution
• Automatic reset: emails are wiped after 7 days, no explicit cleanup needed
• Parallel tests: 30 req/h per IP is enough for 50+ parallel tests with time-sharing

Cost: €0. It is one of the only temporary email services truly usable in CI without paying (versus competing services at €30-100/month for the same volume).