Shelly: The device is already owned by another user/account

This post has two parts. The first part is most likely what you're here for: Getting rid of this stupid error. It turns out that is quite easy and I will explain in a second. The second part, however, is how this (apparently) happens, how Shelly deals with this issue and how Shelly exposed another customer's details to me.

How to fix the error

As you'll read more about in the second part; Shelly apparently sells their devices with duplicate ID's. That is: each unique identifier of their plugs (and apparently also some other devices) aren't that unique.

My plugs have been working nicely since I bought them in June '22, for about 3 months at the time of writing. Today I asked Alexa to switch on one of my Shelly Plug S'es to which she started complaining about the device being offline or unreachable etc. etc. Sigh. Ok, probably it lost it's WiFi connection (which is weird because my WiFi is rock-solid). I went into the Shelly app and noticed the plug was gone - not even available in my account. Weird. I went to the shed, where the plug is located, and unplugged it and plugged it back in. That should do the trick... Nothing.

Looking around in the Shelly app I did notice the device was being discovered fine:

Okay, fine, I'll "Add device" to add it back to where it belongs. Well... Computer says no:

Uuuh... well, that's... weird. After trying a few times, resulting in the same error every time (lookup Einstein's definition of insanity) I started looking into ways to maybe "unbind" or "remove" or "delete" the device from my account. No such luck; I couldn't find any option in the app nor the web-interface of the plug nor in the home.shelly.cloud dashboard. Googling the error itself didn't seem to yield many useful results (at the time of writing, so hence this post).

Ok then, last resort: Contact support. And, to their credit, I emailed them on a Sunday evening at 8:46 PM and got a response at 8:59. That's 13 minutes! Chapeau! After a few messages to and from they replied:

Dear Rob,

Please, execute this command: http://deviceip/longifyid (replace "deviceip" with the real IP of your device)

It will factory reset it and you will have to include it again and then the problem will be resolved.

Please note that if the command does not work, then you have to update the firmware of the device and send the command again.

And this worked, exactly as explained by Shelly. Note that this WILL factory reset your device. Which means you need to put on your clothes, go outside, head into your cold shed and stand there swearing while you're connecting to the device's local AP and connecting to 192.168. 33.1 to re-enter your WiFi network credentials. This ALSO means you then get the joy of setting up your device all over again; including configuring it with Amazon's Alexa - changing the plug-name back to the name it was before it got factory reset doesn't work (which makes sense, Alexa most likely uses the device ID (or some related ID) which got reset in the process). Anyhow... this is where it ends if you don't care about what went wrong, how this could happen in the first place and aren't as inquisitive as some other people are...

Update 2022-10-04: A little bit more information can be found here but that requires you to create an account. Luckily their terms of use, as I read them, allow me to reproduce the information there:

HOW TO DO WHEN CLOUD LOGIN ERROR: "THE DEVICE ALREADY BELONGS TO ANOTHER USER/ACCOUNT."

How do I change a short ID (6 digits) to a long ID (12 digits).

Procedure in the event of a failed attempt to connect Shelly to the cloud.

Notice!

Firmware status on the Shelly should always be the latest. The latest firmware can already be installed when integrating the device via the web interface (192.168.33.1) or via an OTA update, e.g. here from the firmware archive https://www.shelly-support.eu/index.php?shelly-firmware-archive/ to be installed.

Under certain circumstances, when attempting to activate cloud access for a device, the following or similar error message may appear in the app:

"The device already belongs to another user/account."

Reason for this error message:

1. the device is/was really still registered in another user's account and has not been deleted/deactivated

2. There may be an ID conflict between a 6-digit ID of older Shelly devices and the later 12-digit device IDs

If it is a Shelly with a 12-digit ID and the error message appears when trying to activate cloud access, it is necessary delete the device from the previous owner's account.

Here you have the option of creating your ticket with Allterco Support https://ticket.shelly.support/open.php by providing the device ID.

The device ID can be found in the WEB-UI (web interface) or in the app under Settings->Device information or Settings->Device info

If it is a 6-digit ID, it must be extended to 12 digits.

Attention: This procedure involves a reset to the factory settings!

Method:

http://<shelly-ip>/longifyid

into the address line of the browser. Instead of "<shelly-ip>" the IP address of the relevant device has to be entered.

After completion and reset, the device must be reconnected to the existing network and set up again. The connection to the cloud should now also be possible.

Especially the text highlighted in yellow is new; as it turns out even the "longified" ID's can run into this issue. I'm guessing these are returned or second hand units.

The bigger issue

So the "longifyid" part of the URL and the "already owned by another user/account" part bugged me. I could tell the entire story of what happened but I'll begin with the emails that were sent from and to Shelly's support; they'll tell most of the story:

Hi,

My Shelly plug S which has been working fine the past few months suddenly disappeared from my Shelly app. I can still see it and control it from the "Discovered devices" section, but it won't let me add it back to my account. See attached screenshots.

Device ID: 88XXXX (893XXXX)

I have tried the FAQ / Knowledgebase but couldn't find a solution to this issue. Please advise.

With kind regards,

Rob

The screenshots mentioned in the email are the same screenshots at the top of this post. As said, I got a response fairly quickly:

Thank you for reaching out to us!

The device with ID: 88XXXX (893XXXX) is assigned to the following account:

Do you want us to delete that device from the Shelly Cloud?

Uh, holup! That is NOT my email but another person's email!

Hi!

That is most definitely NOT my account nor e-mail address. Please delete it so I can bind it back to my account. Also: How does this happen?

Rob

Shelly's, again, quick, response:

Please, execute this command: http://deviceip/longifyid (replace "deviceip" with the real IP of your device)

It will factory reset it and you will have to include it again and then the problem will be resolved.

Please note that if the command does not work, then you have to update the firmware of the device and send the command again.

My reply:

Thank you, I will do that. However: how come I can't find any of this information in the FAQ nor Knowledge Base? And it still doesn't answer my question on how this happens in the first place?

Shelly:

The reason why you are getting this error when adding the device in the application is because the ID of your unit is against another device with the same ID in our cloud server that is already registered.

We will add that issue to our FAQ.

Please let us know if you have further questions!

Yeah, no, I'm not happy with that answer...

Hi!

I understand that my plug's ID "conflicted" with another customer's plug-id. My question is: how did that happen?

What is even more worrying is that you provided another customer's email address (elXXXXXXXXXXy@gmail.com which qualifies as a data breach).

From that point on I raised more questions and got more, maybe intentionally, maybe not, vague answers, and confusion ensued. The rest of the conversation can be read here. I am not very happy on how Shelly handled the case from the beginning and in the end tried to get rid of me by offering me 15% off of my next purchase (which I'd have to make before Jan. 3rd 2023) but I also don't have enough energy to pursue this any further. They did apologise and I'll have to take their word for it on taking actions for righting the wrongs and... that's about it I guess.

The main takeaways are:

1. Shelly produces (or produced) devices with duplicate ID's. Shelly doesn't proactively warn their customers, nor did they, at the time of writing, include information on how to fix this in their FAQ section nor Knowledge Base. Shelly has said they will include this information. Shelly didn't provide any information on how these duplicate ID's happened in the first place - they could've 'longified' the ID as soon as their expected range overflowed.
2. Shelly provided another customer's email address (along with a plug name and presumably ID) which is a data breach and GDPR violation. Shelly doesn't seem inclined to report this to the authorities. I can't say for sure, n = 1, but I am convinced Shelly has done this on more than one occasion.
3. You may want to 'longify' your Shelly device ID's before you set them up further; there's a real ('small' according to Shelly) chance of a collision - this chance will increase as might be expected unless Shelly starts 'longifying' the ID's from factory; Shelly has said they "are working on adding that feature on a future Shelly Cloud app major update".
4. Though Shelly has tried to assure me on several occasions that my data was, and is, safe and that the other customer at no point was able to control my plug, I am sceptical. You make up your own mind on this matter.

Don't get me wrong; I like Shelly's products and their support has been quick to respond and been very kind to (try and) answer my increasingly probing and critical questions. The point of this post is to make people aware of potential issues.