A password reset email arrived and you didn’t ask for it.
The email looks routine: a reset link or a code, from a service you use. You didn’t click “Forgot password,” and nothing else seems different.
Most of the time an unrequested reset is a request somebody else started, and the account has not changed. A reset email tells you that your address was entered somewhere. It does not tell you that anyone got in.
Three causes Microsoft lists
For a verification code you didn’t request, Microsoft gives three possible causes:
- Someone is trying to access your account.
- Someone typed the wrong phone number or email address while signing in to their own account.
- A code you requested some time ago was delayed and arrived late.
Three checks before you click anything
- Check the sender. Microsoft says legitimate account verification emails come from an @accountprotection.microsoft.com address. For any other service, don’t use the link in the email. Type the service’s address into the browser yourself.
- Look for a second email. A notice that a password or username was changed, when you changed nothing, is one of the signs the FTC lists for a hacked account. So is being unable to sign in.
- Check the security info on the account. On a Microsoft account, sign in to the Security basics page (account.microsoft.com/security) and select Update info. Confirm every phone number and email address listed is yours and that you can reach it.
What to leave alone
Microsoft’s instruction is “Do not respond to any codes that you did not request.” Without the code, someone trying to get in cannot. Don’t enter it, and don’t read it to anyone who contacts you.
If the codes keep arriving, Microsoft suggests going passwordless for a personal account, which removes the password and signs you in another way, such as Windows Hello or a security key. That page covers Microsoft accounts. It does not describe a work account managed by an administrator.
The same goes for approval prompts on your phone. Approving one you did not start hands over the sign-in, so decline it and treat the account as one to review.
When the reset email itself is the trap
Microsoft’s anti-spoofing documentation shows a phishing message that forges the sender so it appears to come from a Microsoft service, and urges the reader to select a change-your-password link. The same page shows a genuine password reset message and says the two are hard to tell apart. Microsoft adds that people used to suspicion may ignore a real one.
That is the reason to avoid the link in either case. If you want to know whether the account needs attention, go to the service directly and look at its security page. A real reset will not be lost by waiting. A fake one asks you to act on the spot.
Signs it is more than a stray request
The first sign matters most. The FTC explains that someone who controls your email can request reset links for your other accounts and lock you out of them. Several resets together point at the mailbox they all go to.
- Reset emails arrive for several different services at the same time.
- A “your password was changed” notice for a change you didn’t make.
- You are locked out of an account you used that day.
- A recovery phone number or email address you don’t recognize.
- A sign-in notice from a device or place you don’t recognize.
If the signs fit
- Open the mailbox the resets went to. Look at forwarding rules, Sent Items, and Deleted Items. The FTC advises deleting any rule you didn’t set up.
- Change that mailbox’s password from a computer you trust, then sign out of all devices.
- Turn on two-step sign-in, and review the recovery addresses and phone numbers.
- Then change the password on each account that sent a reset notice, starting with banking.
What we check with you
Which account each email names, whether the account’s sign-in history shows an attempt or a success, and the rules and forwarding on the mailbox the messages went to. Each answer comes with the date we looked.
A reset email tells you someone typed your address, and the sign-in record tells you whether that was all.
Related
Sources
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.