What to Do When You Receive a Password Reset Email You Didn't Request

An unexpected password reset email can be alarming. It does not automatically mean someone accessed your account: someone may have entered your address in a recovery form, or the message may itself be a phishing attempt.

## Do not use the email link to investigate Open the service's official app or type its known website address yourself. Sign in normally and look for recent activity, security alerts and changes to recovery information. Do not call a phone number supplied in an unexpected message.

## Check for evidence of unauthorized access Look for unfamiliar sessions, changed passwords and altered recovery details. An approximate login location alone is not proof: network routing and VPNs can affect it. If you cannot sign in, use the service's official recovery process.

## Secure an affected account If you find evidence of unauthorized access, change the password using the official service. Choose a unique password; change it on any other accounts where you reused it. Enable multifactor authentication or passkeys where available, and store recovery codes securely. Never give a one-time code to an unexpected caller or message sender.

## Recognize a fraudulent reset message Be wary of unfamiliar domains, urgent demands and requests to reveal codes or passwords. Logos and professional formatting are not proof that an email is genuine. Report phishing using your mail provider's reporting option when appropriate.

The bottom line: investigate through the service itself, not through the unexpected email. A reset message is a reason to check, not proof of a compromise.

## Sources and further reading CISA: Recognize and Report Phishing — https://www.cisa.gov/secure-our-world/recognize-and-report-phishing FTC: How To Recognize and Avoid Phishing Scams — https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams