Is it safe to click the link in a password reset email?

Only if you requested the reset yourself and you are certain the email is genuine. If the email arrived unexpectedly, do not click. Instead, go to the service's website directly and request a new reset if needed.

What should I do if I receive a password reset email for an account I don't have?

Ignore it. Someone may have typed your address by mistake, or it could be a phishing attempt. Do not click any links or reply. Mark it as spam if it persists.

Can a password reset email be a scam even if it looks real?

Yes. Scammers can spoof sender addresses and create convincing fake login pages. Always check the link destination by hovering over it, and never enter your password on a page you reached through an email link.

What if I already clicked the link and entered my password?

Change your password immediately on the real service, and enable two-factor authentication if you haven't already. Check for any suspicious activity and report the incident to the service.

Should I use a disposable email for password resets?

Disposable emails are not ideal for password resets because the inbox expires and you may lose access. Use a real or alias address for important accounts. For low-risk signups, a disposable address can reduce spam.

Password Reset Email Scams: How Fake Reset Messages Trick You

Password reset email scams are phishing attacks that use a fake 'reset your password' message to steal your credentials or install malware. When you receive an unexpected password reset email, the safe response is to ignore the link and, if you are worried, go directly to the service's website by typing its address – never through the email. If you did not request a reset, the message is either a mistake by someone who typed your address or a deliberate attempt to trick you.

Why would someone send you a password reset email?

There are two broad reasons: genuine mistakes and malicious intent. Understanding the difference helps you choose the right response.

Genuine mistakes

Someone with an email address similar to yours might have typed yours by accident. Or you may have signed up for a service years ago and forgotten about it. In these cases, the reset email is real – it comes from the actual service – but you did not ask for it. This is the most common explanation for a single, well-formed reset message from a service you recognise.

Malicious intent

Scammers send fake reset emails that look like they come from a real service. The goal is to get you to click a link that leads to a fake login page where you enter your password, or to download malware. These emails often use urgent language and threaten account closure.

Sometimes attackers use a real password reset request to test whether your email address is active, or to flood your inbox so you miss a genuine security alert. A sudden burst of reset emails from many different services is a stronger warning sign than a single one.

How can you tell if a password reset email is real?

Check these signs before you click anything:

The sender address: Look at the full email address, not just the display name. Genuine services use their own domain. Scammers often use lookalike domains or free email providers.
The link destination: Hover over the link (on desktop) or long-press it (on mobile) to see the real URL. The domain should match the service exactly.
Personalisation: Real reset emails often include your name or part of your account details. Phishing emails are often generic.
Urgency: Threats like 'your account will be closed in 24 hours' are a red flag.
Grammar and spelling: Poor language is common in scams, but some are well-written.

For a deeper checklist, see our guide on how to spot a phishing email.

If you are still unsure, do not use the link. Instead, open a new browser tab and go to the service's website directly. If the reset was genuine, you can request a new one there. Reading the raw email headers can also reveal whether the message really came from the service's domain – our guide on how to read email headers walks through the fields to check.

What should you do if you receive an unexpected reset email?

Your response depends on whether you have an account with the service.

If you have an account

Do not click any links in the email.
Open a new tab and type the service's address manually.
Log in and check your account activity for unfamiliar devices or sessions.
If you see suspicious activity, change your password immediately and enable two-factor authentication if you haven't already.
If the reset email keeps coming, contact the service's support team.

If you do not have an account

Someone may have used your email address by mistake or on purpose. You can ignore the email, but if it becomes a nuisance, mark it as spam. Do not unsubscribe from a service you never joined – that confirms your address is active.

If the email asks you to confirm your password

Legitimate services never ask you to confirm your password by email. This is always a scam. Report it to the service's phishing address if you can find one.

How do password reset scams work?

Scammers use several techniques to make their fake reset emails convincing.

Lookalike domains: They register domains that resemble the real one, like 'paypa1.com' instead of 'paypal.com'.
Spoofed sender addresses: They forge the 'From' address to match the service. Email authentication (SPF, DKIM, DMARC) can help detect this, but not all services enforce it. Our article on SPF, DKIM and DMARC explains more.
Fake login pages: The link leads to a page that looks like the service's login, but it captures your password.
Malware attachments: Some emails include attachments that install malware when opened.

Another tactic is to send a real password reset request to your address, hoping you will click the link and then enter your password on a subsequent fake page. Always verify the domain before typing anything into a form.

What if the reset email is for a disposable address?

If you used a temporary email address to sign up for a service, you might receive a password reset email there. Since the inbox is temporary, you may not be able to access it later. This is a good reason to use a disposable address only for low-risk signups where password recovery is not important. For accounts you care about, use a real or alias address.

If you do receive a reset email in a temporary inbox, treat it with the same caution. Check the sender and links. If it is genuine, you can use it to reset the password – but remember the inbox will expire. Our guide on how long temp mail lasts explains the timers. It is also worth remembering that a disposable inbox is receive-only, so you cannot reply to a support team or prove ownership of the address if a service asks you to.

How can you protect yourself from password reset scams?

Adopt these habits to reduce your risk:

Use two-factor authentication: Even if a scammer gets your password, 2FA can stop them. Our guide on two-factor authentication covers the options.
Use a password manager: It will not autofill your credentials on a fake domain, alerting you to a scam.
Check the domain carefully: Before entering any password, verify the URL in the address bar.
Keep your email address private: Use aliases or disposable addresses for signups to limit exposure. See our post on email aliases vs disposable email.
Report suspicious emails: Forward them to the service's phishing report address, then delete them.

For a broader set of habits, read how to avoid spam emails. If a scammer does get hold of your credentials, our guide on what to do after a data breach covers the recovery steps in order.

Sources

NIST Special Publication 800-63B: Digital Identity Guidelines – authentication guidance, including password and 2FA recommendations.
Google: Avoid and report phishing emails – practical advice from a major email provider.
RFC 7208: Sender Policy Framework (SPF) – explains how sender domains can be checked, which helps in spotting spoofed reset emails.

In short

Unexpected password reset emails are either genuine mistakes or phishing attempts. Never click the link in an unexpected reset email. Instead, go to the service's website directly and check your account. Use two-factor authentication and a password manager to stay safe. If you used a disposable address, remember that the inbox is temporary, so use it only for accounts where recovery is not critical.