Fake Password Reset Emails to Be Cautious About
Best password managers of 2024
How phishing emails work
Google’s security alert
Ever felt the shiver down your spine when an email urgently demands you reset your password or face imminent doom? One of the oldest (and most used) internet scams in the book is phishing emails: unsolicited messages that look legitimate and prompt the user to change their password for an online account.
In this ever-expanding digital era full of numerous accounts with different usernames and passwords, cyberthreats are more common than we think. In fact, password reset emails are commonplace for recovering social media access or other accounts like Apple ID, eBay, and Amazon.
Fortunately, there are plenty of ways to recognize fake password reset emails and keep your information secure. Understanding how phishing emails work is the first step to maintaining your email security.
Best password managers of 2024
Effective security center
Intuitive and organized interface
Automated password categorization
Various two-factor authentication options
Secure authentication method
One-time password support
Wide range of platform support
Effective password generator
How phishing emails work
Using strong and unique passwords for all your accounts and securely storing this sensitive data in a trustworthy password management app will safeguard your credentials from many security risks. However, not even a cryptographically perfect password will protect the user if it’s handed directly to a hacker.
Unfortunately, hackers rely on the fact that we regularly receive reset emails. By disguising themselves as legitimate senders, these hackers distribute malicious links or attachments that can perform many functions. Their intentions lie in extracting login credentials and account information.
Have you ever received an email from an internet-based service claiming that you’ve requested to change the account password, even though you haven’t? If yes, you are not alone.
Millions of users worldwide are the target of such attacks every day, and there will be millions more. The most important thing is to take measures against these phishing attacks to protect your digital identity and financial data.
Before we go into tips for identifying those malicious emails, let’s go over the most common password reset emails.
Google’s security alert
Several people have been reporting fraudulent emails that claim suspicious activity is happening with their accounts. While the email looks like it comes from Google at first, when taking a closer look, it’s possible to see that the sender is not Google but a random email username.
The body of the email urges the users to change passwords and log into their accounts to see said malicious activity, providing a link to both activities. To the inattentive eye, the email looks legitimate, but it could cause the hacking of the Google account, compromising the security of all information stored on it.
Fake Instagram support emails
Common Instagram fake password reset emails contain a link to website that looks like Instagram, alerting users of unusual logins and asking them to start the process of changing passwords via the link attached to the email.
To change their passwords, users are asked to provide their current account credentials. That’s exactly how the hackers get their private information and gain access to their accounts.
While not exactly a fake password reset email, other ways to get your information involve third-party apps. These platforms usually advertise features that are not available on Instagram, such as seeing who visited your profile or who blocked you.
However, in reality, most apps do not show correct information and are made to collect your credentials and sell them to hackers. Remember to display your credentials only on official apps and websites to prevent this from happening.
Fake Facebook account recovery code emails
Much like phishing emails, fake Facebook reset password messages are common and almost always look like they come from a trustworthy sender. The most frequently occurring message states that someone attempted to change their account password without authorization.
Recipients are then provided with a six-digit recovery code (that’s completely made up) and redirected to another page to enter the code alongside their account credentials, which are then stolen.
It’s important to keep an eye out for creative scams like this, and to always double-check everything before submitting any kind of information to a website that’s not the platform’s main domain.
Fraudulent Apple impersonators
Apple is one of the most impersonated entities when it comes to fake emails. With several different services, these scams may look like they are sent from the App Store, Apple Pay, Apple Music, or any other areas of the Apple ecosystem. The main purpose of these fraudulent emails is to retrieve your credentials, such as Apple ID and passwords needed for accessing any Apple services.
The most frequent type of fake password reset emails have the same hallmarks of the Facebook imitation emails, and usually involve verification codes. The scammers ask users to change their passwords while also redirecting them to a third-party website. Following this, you’re requested to log into your account with current information, making it easily accessible to the hackers.
If you receive an unsolicited notification asking you to reset your password, the best thing to do is ignore it. Plus, it’s possible to report scam emails to Apple directly, preventing the phishing attempts from being successful with you or any other person receiving them.
Fake ‘verify your identity’ Amazon emails
The most used fake reset password emails when it comes to Amazon are related to the platform needing users to confirm their identity due to ‘unauthorized’ attempts to reset their account password.
Several people reported being subject to this email phishing attempt that appears to be a genuine Amazon message. Conveying a sense of urgency for users to change their passwords, these emails are designed to make people panic and act fast without thinking twice about the legitimacy of the sender.
However, fake Amazon emails may take other forms too, such as gift cards and account recovery messages, and all aim to gather any type of information they can from you.
eBay ‘change your password now’ emails
Still affecting people daily are emails supposedly from eBay notifying users that there has been suspicious activity on their account. In order to ‘protect’ their account, the malicious message asks for login credentials while providing a link for users to change their passwords.
Since threats like this are common, eBay has listed several ways to ensure scam emails are recognizable. It’s also created a report channel for people to list the exact sender that tried to scam them, and how.
5 best tips to differentiate a real email from a fake
Most scam emails follow the same structure and content, and once you’re familiar with those, you’ll be able to identify phishing messages and not fall for their fraudulent tricks. From generic greetings that lack personal touch or authenticity of the brand, to urgency and looming threats that set the stage for manipulation, each characteristic serves as a reminder that keeping your information safe is an on-going task. Here are the usual fake email traits:
- Generic greetings: Legitimate password reset emails typically address you by your name or account name. Be wary of messages that use greetings such as ‘dear customer’ or ‘dear user’.
- Urgency and threats: Scammers use urgency and threats to manipulate recipients into acting fast. If an email claims that immediate action is required to prevent dire consequences, it should raise suspicion.
- Unusual sender addresses: Always be sure to check the sender’s email carefully. Cybercriminals often use email addresses that resemble legitimate ones but have subtle variations.
- Incorrect URL links: Look over all of the links in the email before clicking on them. If the displayed URL seems different from the official website, it is likely a phishing attempt and should be avoided at any costs.
- Grammatical errors: Many fake emails contain grammatical errors or awkward language usage. Legitimate organizations won’t send emails that don’t follow a high standard of communication, so spotting typos or mistakes is usually a sign of a malicious email.
A recap of red flags
Once you become familiar with the types of phishing attempts, keeping yourself safe from them becomes a breeze. However, it’s always wise to keep an eye on suspicious activity.
Be aware of urgent pleas in emails, as well as generic greetings, unusual sending addresses, and anything that may feel different from the official platform the email should come from. Using password managers that send password renewal alerts gives you peace of mind, as you’ll know that any email prompting you to change your password is fraudulent.
Storing your information in encrypted vaults with password managers, regularly changing them with new and strong combinations, as well as activating two-factor authentication are great methods for keeping safe and secure in the online world.
Stay tuned, stay cautious, and be sure to always double-check before clicking any links or submitting personal information online.
Best password managers of 2024
Effective security center
Intuitive and organized interface
Automated password categorization
Various two-factor authentication options
Secure authentication method
One-time password support
Wide range of platform support
Effective password generator
István F.
Micaela A.
Adam B.
Even knowing the potential threats it eventually happened to me, because like stated in the article I got so used to resetting my passwords, that I didn’t pay much attention and clicked on the fake email which then in turn led me to its fake website.
I need to get child lock off because my granny accidentally put it on