Answers.Body: <p>As soon as you automatically "merge", it will never be 100% safe. If you want to be sure, never dedupe (ie put dedupe rules that are not possible to match) and ask your users to login.</p>
  
  <p>Obviously, it means that you will end up with tons of duplicates, so in practice, you will need to relax the rules and accept that you might have two different persons that end up merged in the same contact. This isn't as bad as it sounds, and it happens with every shared list of items that several people can update, and it doesn't create too much problems.</p>
  
  <p>So your choice is what type of error you want to avoid more: having more duplicates or having more incorrect merges. For what I've experienced, the most relaxed rule is to consider that everyone sharing an address is the same person, and the strictest want the first and last name and email and country.</p>
  
  <p>you might want to add an extra layer of protection if you send emails with the hash token (so your contacts don't have to login and are automatically identified) so they can't change their name by accident with this extension <a href="https://civicrm.org/extensions/no-overwrite" rel="nofollow">https://civicrm.org/extensions/no-overwrite</a></p>
  
  <p>And you could enable the detailed logging <a href="http://book.civicrm.org/user/advanced-configuration/logging/" rel="nofollow">http://book.civicrm.org/user/advanced-configuration/logging/</a> so you keep the history of all the changes if you haven't done it already</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T14:10:18.803Z
Answers.Text: Our rules are even stricter! Names, email address and some of their membership information all need to match in order for us to 'automatically' merge the accounts. From a data protection standpoint, having two people incorrectly merged could be quite a serious error.
Answers.UserDisplayName: John
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T19:18:06.597Z
Answers.Text: What do you mean by automatically merging? is this the dedupe rule applied to the visitors (unsupervised) or are you merging them after they are created as duplicates?
Answers.UserDisplayName: Xavier
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T19:21:13.307Z
Answers.Text: This would be the unsupervised rule. We also have less strict 'general' rules which we would manually process in the 'find and merge duplicate contacts' screen.
Answers.UserDisplayName: John
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T12:41:43.703Z
Answers.LastActivityDate: 2015-12-14T19:17:06.177Z
Answers.LastEditDate: 2015-12-14T19:17:06.177Z
Answers.UserDisplayName: Xavier
Answers.Body: <p>fill email address of someone else (so it will match with that person), then use different name/phone number/employer/membership/event sign up etc...</p>
  
  <p>It would mess up your system, and your communication to original contact. That could be advantage enough for them.</p>
  
  <p>Above is a theoretical possibility. In real life I have never seen it happen. So in my opinion it is safe to use it and do an automated merge only by e-mail.</p>
  
  <p>I do have a customer who for this reason chose to not merge new contacts with existing ones and de-duplicate only manually.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T09:33:54.667Z
Answers.Text: So you should match on more than just the email address- some people share them legitimately.
Answers.UserDisplayName: DaveFF
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-14T09:43:33.397Z
Answers.Text: see the addition I made.
Answers.UserDisplayName: Catorghans
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2015-12-13T21:37:17.500Z
Answers.LastActivityDate: 2015-12-14T09:42:30.710Z
Answers.LastEditDate: 2015-12-14T09:42:30.710Z
Answers.UserDisplayName: Catorghans
Body: <p>When is it safe (and when might it not be safe) to automatically de-duplicate contacts submitted from a public facing form? </p>
  
  <p>How might a malicious user leverage automatic contact merges to their advantage?</p>
  
Tags: <duplicate-contacts><security>
Title: In what circumstances is it safe to automatically de-duplicate contacts?
ThreadText: # In what circumstances is it safe to automatically de-duplicate contacts?
  
  (Asked by: username_0 on 2015-12-13)
  
  When is it safe (and when might it not be safe) to automatically de-duplicate contacts submitted from a public facing form?
  
  How might a malicious user leverage automatic contact merges to their advantage?
  
  **Tags:** duplicate-contacts, security
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2015-12-14. Score: 2
  
  As soon as you automatically "merge", it will never be 100% safe. If you want to be sure, never dedupe (ie put dedupe rules that are not possible to match) and ask your users to login.
  
  Obviously, it means that you will end up with tons of duplicates, so in practice, you will need to relax the rules and accept that you might have two different persons that end up merged in the same contact. This isn't as bad as it sounds, and it happens with every shared list of items that several people can update, and it doesn't create too much problems.
  
  So your choice is what type of error you want to avoid more: having more duplicates or having more incorrect merges. For what I've experienced, the most relaxed rule is to consider that everyone sharing an address is the same person, and the strictest want the first and last name and email and country.
  
  you might want to add an extra layer of protection if you send emails with the hash token (so your contacts don't have to login and are automatically identified) so they can't change their name by accident with this extension <https://civicrm.org/extensions/no-overwrite>
  
  And you could enable the detailed logging <http://book.civicrm.org/user/advanced-configuration/logging/> so you keep the history of all the changes if you haven't done it already
  
  > **Comments:**
  > **username_2**: Our rules are even stricter! Names, email address and some of their membership information all need to match in order for us to 'automatically' merge the accounts. From a data protection standpoint, having two people incorrectly merged could be quite a serious error.  
  > **username_1**: What do you mean by automatically merging? is this the dedupe rule applied to the visitors (unsupervised) or are you merging them after they are created as duplicates?  
  > **username_2**: This would be the unsupervised rule. We also have less strict 'general' rules which we would manually process in the 'find and merge duplicate contacts' screen.  
  
  ---
  
  ### Answer by username_3 on 2015-12-13. Score: 1
  
  fill email address of someone else (so it will match with that person), then use different name/phone number/employer/membership/event sign up etc...
  
  It would mess up your system, and your communication to original contact. That could be advantage enough for them.
  
  Above is a theoretical possibility. In real life I have never seen it happen. So in my opinion it is safe to use it and do an automated merge only by e-mail.
  
  I do have a customer who for this reason chose to not merge new contacts with existing ones and de-duplicate only manually.
  
  > **Comments:**
  > **username_4**: So you should match on more than just the email address- some people share them legitimately.  
  > **username_3**: see the addition I made.  
  
  ---
  
  