Currently, email IDs on Merlin accounts can be changed without verification, posing a significant security risk. To prevent unauthorized access and account theft, it's recommended to implement a verification process, such as OTP or email confirmation, during email changes. This measure ensures better account protection and traceability.