I Received a Snapchat Login Alert for an Account I Never Created.

An unexpected security email led me to someone else's Snapchat profile. I'm a computer science student learning cybersecurity, and I want to understand how this was possible.

I'm currently exploring cybersecurity, and one thing I've been learning is that sometimes the most interesting security questions come from things you experience yourself.

Recently, something happened that I genuinely couldn't explain.

I received an email from Snapchat notifying me about a login attempt from a location I didn't recognise.

My first reaction was simple:

"Wait, when did I even create a Snapchat account using this email address?"

I had never knowingly created a Snapchat account with that email address. The location mentioned in the email wasn't mine either.

Naturally, I became curious. Instead of ignoring the notification, I decided to investigate what was going on.

What happened next left me with more questions than answers.

I tried logging in. And that is where things got strange.

I opened Snapchat and attempted to log in using the same email address that had received the security notification.

And somehow, I ended up inside a Snapchat account.

But there was one major problem.

The account wasn't mine. Not even remotely.

It wasn't an empty profile or some incomplete account waiting to be set up. It looked like a normal, established Snapchat account, with the person's photos, content, and personal memories.

I had never created this account, and I didn't recognise it as mine.

I was confused. How could an email address I had access to lead me into an account belonging to someone else?

At first, I wondered whether I had misunderstood something. So I logged out and tried to understand the login process more carefully.

That was when I noticed another detail.

The phone number associated with the Snapchat account was different from mine.

Now I had two questions:

Why was this email address associated with a Snapchat account I had never created?
How could I access that account when the phone number displayed on Snapchat wasn't mine?

I couldn't find an explanation.

Is Gmail allowing two people to use the same email address?

This was my first thought.

Was it possible that two different people were somehow using the same Gmail address? Had the email address been linked to someone else's Snapchat account? Or was something going wrong in the way Snapchat associated email addresses with user accounts?

I want to be clear about something: I don't know whether the email account was previously used by someone else, whether another person had added the address to their Snapchat account, or whether something else happened.

I also don't have evidence that two people were actually sharing the same Google account.

What I know is what I experienced: I received the notification, attempted to log in using that email address, and reached a Snapchat profile that wasn't mine.

That distinction matters because I don't want to accuse either Google or Snapchat of having a security vulnerability without understanding the technical details.

But I do want to understand how this situation was possible.

I tried to delete the account. Then I hit another problem.

Once I realised that the account belonged to someone else, I didn't want to remain logged in.

I tried to change the password and looked into deleting the Snapchat account, but I encountered an error. The deletion process required a password that I didn't have.

And honestly, that left me in an uncomfortable position.

On one hand, I had access to an account that clearly wasn't mine. On the other, I couldn't establish ownership of it or complete the deletion process.

Looking at the account's photos and memories made me realise that this wasn't just some random profile. There was a real person behind it, with their own digital history.

Deleting an account like that without understanding what was happening didn't feel right to me.

I didn't want to risk destroying someone's photos, memories, or other personal content simply because I had unexpectedly gained access.

Eventually, I logged out and removed that email account from my phone. I didn't want to keep accessing someone else's profile, and I didn't want to remain involved with an account I couldn't explain.

But the underlying question remained unanswered.

How did this happen in the first place?

What could have happened behind the scenes?

Since I'm learning cybersecurity, I started thinking about the possible technical explanations. I don't know which, if any, applies to my situation, but these are the questions I'd investigate.

Was the email address linked to the Snapchat account without my knowledge?

Could someone have entered this email address when creating or updating their Snapchat account? If so, was the address verified, and what does Snapchat do when an email address is associated with an account that its actual user doesn't recognise?

Was this an account recovery or authentication issue?

What exactly did Snapchat authenticate when I attempted to log in? Did it validate the email address, use a previously saved session, or follow some other flow?

I don't know whether I encountered a normal login flow, an account-recovery flow, or another mechanism. Understanding that distinction seems essential.

Could this be an account-association bug?

Could there be a situation in which a platform incorrectly associates an email address with a user account?

If so, what evidence would be needed to distinguish a genuine application bug from a configuration issue or an account that was registered with the wrong email address?

Was the security notification itself connected to the successful login?

I initially received an email about a login attempt from an unfamiliar location. I would like to understand whether that notification and the profile I accessed were directly connected, and what the wording of the alert tells us about the event.

These are hypotheses, not conclusions. I haven't performed a technical investigation that would establish the root cause.

Is this a vulnerability, a configuration issue, or something else?

This is the part I would really like to understand from people with experience in application security.

We often talk about authentication as if it were a single step: enter your credentials, prove who you are, and access your account.

In reality, an application may involve several different mechanisms, including email verification, password authentication, existing sessions, account recovery, and additional verification factors.

An email address being associated with an account is not necessarily proof that the person currently accessing that mailbox owns the account.

Similarly, receiving a login alert does not automatically mean that an account has been compromised.

However, if someone can access another person's account through an unintended authentication flow, that could be a serious security concern.

The question is what actually happened in this case.

I don't have the logs, internal account records, or technical evidence needed to determine that. Only a proper investigation could establish whether there was an implementation flaw, an account-association problem, or another explanation.

I'd genuinely appreciate help from the tech community

I'm publishing this because I want to learn, and I suspect there are people who understand these systems far better than I do.

If you're an application security engineer, authentication developer, cybersecurity researcher, or someone who has worked on account recovery systems, I'd appreciate your perspective.

Here are the questions I'd love to discuss:

How could a person enter an email address and end up inside an existing Snapchat account they never created?
What role could email verification and phone-number verification play in this situation?
What logs or evidence would help distinguish a normal login flow from an authentication or account-association vulnerability?
Which team would normally investigate this: the email provider, the application provider, or both?
What would be the responsible way to report this and ensure the actual account owner is protected?

I'm particularly interested in hearing from people who have investigated identity and authentication issues in real-world applications.

Why I'm sharing this

I'm still learning cybersecurity, and I don't pretend to know the answer to every security question I encounter.

But I believe sharing an unusual experience, explaining what we actually observed, and asking the right questions can be a useful starting point.

I don't want to label Gmail insecure or accuse Snapchat of having a vulnerability without evidence. I want to understand what happened, whether anyone's account was put at risk, and what the appropriate response should be.

For now, I've stopped accessing the account and removed the email account from my phone.

The incident has left me thinking about something important: our digital identities depend on systems that most of us use every day without knowing how they work internally.

When those systems behave unexpectedly, understanding the reason matters.

If you've encountered something similar, or if you work in authentication or application security, I'd genuinely appreciate your technical perspective.

I'm here to learn, and I'd love for this experience to become a useful discussion about digital identity, account security, and the questions we should be asking when something doesn't seem right.

Note: This article describes my personal experience. I have not independently verified the cause and am not claiming that a vulnerability in Gmail or Snapchat has been established. No identifying details of the other account are included.