Is a password reset email I didn't request a scam?
An unsolicited password reset email usually means someone is trying to take over your account or test whether it exists. Do not click the reset link — just ignore it or secure your account.
Last reviewed: 1 August 2026
Explanation
Receiving a password reset email you did not request can mean several things: a scammer is attempting to break into your account and triggered the reset, someone typed your email in error, or your email was included in a credential-stuffing attempt. Simply receiving this email does not mean your account has been accessed — but it is a warning sign. The risk is if you click the link (which may be a phishing link in a fake reset email) or if you are using a weak, reused password.
It helps to separate the two scenarios. If the email is genuinely from the service, someone entered your address on the real reset page; nothing changes unless the link is used, so you can safely ignore it and the request will expire on its own. If the email is fake, the entire message exists to get you to click, and the 'reset' page will harvest whatever you type into it. In both cases the correct move is the same: do not interact with the email at all.
Instead, log in to that service directly through its official website or app, check recent sign-in activity for anything you do not recognise, and enable two-factor authentication. If you reuse that password anywhere else, change it everywhere — a burst of reset emails across several services often means your address and an old password are circulating from a data breach.
Common red flags
- You did not request a password reset
- Multiple reset emails for different accounts in quick succession
- The email sender domain does not exactly match the service
- Link in the email goes to a domain different from the official service
What to do now
- Do not click any link in the email if you are unsure of the sender
- Log in to the account directly through the official website
- Change your password if you reuse it across multiple services
- Enable two-factor authentication on the account
Frequently asked questions
Should I click the reset link to cancel the request?
No. You do not need to do anything — the link will expire automatically. Clicking it confirms your email is active and may lead to a phishing page.
I keep getting reset emails for the same account. Should I worry?
Repeated requests suggest someone is actively trying to get in. Log in directly, review recent activity, set a strong unique password, and enable two-factor authentication. The attempts cannot succeed without access to your inbox or codes.
How do I tell a genuine reset email from a fake one?
Check the sender domain and, without clicking, inspect where the link actually points. When in doubt, ignore the email entirely and go to the service directly — a genuine reset request never requires you to act on the email.