Agreed that blocking donate@ etc makes sense.

For the larger issue, this is working as designed. The only piece of data we always have to log donors in to the donor portal is their email address, so we have no way to know how that should be differentiated if we have more than one contact with that email address. If that email address is a primary email address for more than one contact, we get the name and address from the contact with the lowest contact id and we get the donations from all contacts.

If they do enter a generic email address that they don't actually own, then they can't use the donor portal link, which can only be delivered by email. When they click a link in the footer of an email, we do know their contact id, so we could only show donations and details for that cid, but if they use the log in page to get a link by entering their email address, we don't know the cid and we couldn't limit the results. I don't think we'd want to show different data depending on how you arrived at the donor portal, so we wouldn't want to limit the data by cid only in the case that we know the cid. Given that, I'm not sure how else this could work. Presumably in the vast majority of cases, when someone enters an email that is primary for more than one contact, showing them all donations is reasonable (same person or maybe a spouse).

Thank you for the information @Lars

It sounds like we should update our documentation to reflect the difference between portal access from email footer (which includes the CID) versus access from the log in page (no CID), which may generate edge case-y results in the event of undeduped emails.

@MBeat33 Sorry if that was unclear, but there is no difference in what a donor will see if they use a link with a CID or without one. It will always be the donation history merged by email. We could make it different, but I think that would be strange and confusing for donors, even more so than it is now.

Thanks, Lars, I was thinking more in terms of the URL that we will see, some will have the CID and some not, is that correct?

@MBeat33 I see. I was extrapolating a bit there about what we could do, but the link will always have a CID in it. Some of them will have come from an email sent to a specific contact, some will come from the donor entering their email in the form to get a link, but all of the links will be in the same form (cid and checksum).

The only work to do here is to block donate@wikimedia.org and other similar addresses (hello@, etc). See Slack.