"Your password expires today." "New sign-in from Russia." These messages work because they trigger alarm. This guide helps you respond calmly. It is part of our section on data breaches and hacked accounts.
Why these scams work
Real services do send alerts like these, so the fake versions feel familiar. Attackers count on fear to make you click before you think. The link leads to a fake login page.
Common versions
- Password expired or expiring. A fake request to "keep your password".
- Suspicious sign-in. A fake alert with a "secure my account" button.
- Mailbox full. Often aimed at work accounts.
- Shared document. A fake login screen to view a file.
- Payment failed. A fake billing page.
- Phone call or text about a code. A person asks you to read out a code you have just received.
The code-stealing call
This one is worth singling out. A criminal who has your password triggers a real login code to your phone, then calls or texts you, pretending to be your bank or provider. They say that they need the code to "verify you" or "stop a transaction".
The code is genuine, and the caller is not. Never read a code to anyone. Backup codes are the same. See backup codes.
How to check safely
- Do not click anything in the message.
- Open the app, or type the site's address by hand.
- Look at your security settings or alerts page. Real warnings usually appear there too.
- If nothing is there, delete the message and report it as phishing.
What to do about a reset you did not request
| Situation | What to do |
|---|---|
| One reset email, no other signs | Ignore it. Your password stays the same |
| Several reset emails | Someone may be attacking. Change your password |
| A login code you did not request | Someone has your password. Change it now |
| You cannot log in | Follow hacked email recovery |
| Other strange changes | Check the signs of a hacked account |
A login code that arrives unexpectedly is the most serious of these, because it suggests that your password is already known.