Phishing Protection
How to Check If a Password Reset Email Is Real
A password-reset email may be a mistake, a legitimate request from another person, a phishing attempt, or an attack against your account. Do not click first. Open the service directly, review activity, and change your password only through the official site.
Why did I receive a reset message?
Someone may have entered your email by mistake, requested a reset for an account you own, or tried to make you click a fake link. Receiving the message does not prove that the password was changed or that someone accessed the account.
- Check whether you requested it.
- Do not click immediately.
- Open the provider independently.
What makes a reset email suspicious?
Be cautious with mismatched sender domains, urgent threats, unexpected attachments, shortened links, requests for codes, and pages that ask for more information than the provider normally needs.
- Mismatched domain
- Urgent language
- Unexpected attachment
- Request for a code
What should never be shared?
Never share your current password, reset code, authentication code, card number, or bank details with someone who contacts you unexpectedly.
Open the service directly
Type the service address manually or use its official app. Check security notifications there and start a reset only from the account settings or official recovery page.
- Avoid email links.
- Use the official app.
- Check account activity.
Secure the account if needed
Change the password to a unique one, sign out other sessions, review recovery methods, and enable multifactor authentication. Change reused passwords on other accounts.
- Use a unique password.
- Sign out unknown sessions.
- Enable MFA.
Report and delete the message safely
Use your email provider's phishing-report option. Do not forward the message to friends or publish its links. Keep a screenshot if you need evidence.
- Report phishing.
- Do not open attachments.
- Preserve evidence privately.
Use exposure checks correctly
A 4safer result can show known exposure context for an owned email. It cannot validate the email's authenticity and a negative result does not guarantee safety.
Frequently asked questions
Should I change my password after an unexpected reset email?
If the message is unexplained, open the service directly and consider changing the password, especially if it was reused.
Can I click the reset link to see where it goes?
No. Use the official website or app instead.
Does a reset email mean someone knows my password?
No. A reset request can be made without knowing the current password.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.