10/25/2026
An email arrives saying someone requested a password reset for your account. You did not request it, but the message looks legitimate, complete with a familiar logo, a professional layout, and a link to "secure" your account. Most people either ignore it or click the link out of concern.
Ignoring it entirely is actually the right instinct, but clicking that link is where things go wrong. Attackers send fake reset emails hoping you will click through to a convincing login page designed to capture your credentials. Once you enter them, your real account is compromised, often within minutes.
If you receive a password reset email you did not request, do not click anything in the message. Instead, go directly to the website by typing the address into your browser and check your account from there. If someone really is trying to get into your account, changing your password directly is the right response.