An email verification code is often treated as proof that a person controls an inbox. That is useful, but it is not the same as proving which browser session started the verification attempt.

This distinction matters in OAuth sign-in, account linking, and passwordless login. If a code is valid on its own, an attacker who obtains it can sometimes redeem it from another browser or attach the verified address to the wrong account. The bug is not always dramatic. It can look like a confusing support ticket: “I entered my code, but the account changed.”

The safer design is to make the code one part of a short-lived, server-side verification transaction.…