How to Spot a Fake Password Reset Email

A password reset email just landed in your inbox. Pause and count the flags before you touch the button. This quiz walks through one fake message, flag by flag, so you can test what you caught.

The message is fictional. It claims to be from VaultKey Accounts, a made-up service created for this episode and labelled fictional on screen. No real service sent it. The four red flags hiding in it are real.

Flag 1: You never asked for this reset

The first flag is the arrival itself. You never asked for this reset. It arrived unexpected, out of nowhere.

That pattern is a known phishing sign. The Federal Trade Commission says you might get an unexpected email or text message that looks like it is from a company you know or trust. A reset you never requested fits that pattern exactly.

Microsoft gives the matching rule: never open links or attachments you were not expecting, even if they appear to come from somebody you trust. So the first check is simple. Did you ask for this reset? If the answer is no, do not click the links in it.

Flag 2: The sender address does not match

The second flag is in the sender line. The message claims VaultKey Accounts, but the actual address says something else: security@vaultkey-alerts.example.

Check the actual address, not just the name shown. Microsoft puts it plainly: if a message claims to be from your bank but the sender's address is not your bank's domain name, that should be a loud warning. The same check applies here, with the claimed service in place of the bank.

CISA lists incorrect email addresses or links among the common signs of phishing. Its own example turns on the same mismatch — the address was not from the vendor's domain. A display name can be written to look familiar. The address underneath it is the part to compare.

Flags 3 and 4: Pressure, no name, and a fake sign-in

The third flag is the deadline. The bait says to reset within one hour, or your account will be locked. That line is part of the fiction. The pattern it shows is real.

CISA lists urgent or emotionally appealing language among phishing signs, especially messages that claim dire consequences for not responding immediately. Microsoft describes the same pattern: something is going to be cancelled, a penalty is coming, and you have to act now. The urgency is there to get you to act without thinking about it too much.

The fourth flag starts with the greeting: "Dear Customer" — no name at all. The FTC's worked example lists a generic greeting as one of the signs. Then the button leads to a fake sign-in asking for your current password. Microsoft says the website behind a link like this will likely be a fake version of a legitimate website, designed to fool you into entering your username and password, or other personal information, so it can be stolen. CISA also lists requests to send personal and financial information as a sign.

How to stay safe

Skip the message's button and link. Do not click links in unexpected messages.

Go to the service yourself, by a way you know is real. The FTC says to contact the company using a phone number or website you know is real — not the information in the email. Microsoft says to go directly to the organisation's website from your own saved favourite, from a web search, or by typing its domain name yourself. In CISA's example, the person always types the retailer's website directly instead of clicking a link in an email.

Run the four checks before you act. Did you ask for it? Does the address match? Is a deadline rushing you? Does it greet you generically and lead to a sign-in asking for your password? One flag is enough to stop.

To practice the same checks on other lures, try the Spot the Phish quiz and the fake document quiz.

If you already did it

If you clicked the button, or entered your current password on the fake sign-in it led to, do not go back through the message to fix it. Do not use its link, button, or contact information.

Use the direct route instead. Open the service yourself through a website you know is real — from your own saved favourite, from a web search, or by typing the domain name yourself — or contact the company using a phone number or website you know is real. That direct route is the remedy the FTC, Microsoft, and CISA guidance gives for this kind of bait, and it is the recovery step this briefing can support from the episode's fact sheet.

If you see these flags again — unasked arrival, mismatched address, lock threat, generic greeting — skip the message and go to the service yourself.

Sources: CISA — Recognize and Report Phishing ↗ · CISA Secure Our World — phishing signs (CCRI) ↗ · FTC — How To Recognize and Avoid Phishing Scams ↗ · Microsoft Support — Protect yourself from online scams and attacks ↗