Angvlar Security Awareness
Password reset scams
Recognise fake password reset and account-expiry messages without exposing your credentials.
Why this matters
Password resets are effective lures because they create urgency and lead to convincing sign-in pages. Legitimate resets should be initiated from the service you already know, not from an unsolicited link.
By the end of this lesson
- Recognise the main warning signs
- Choose a safe verification method
- Know when and how to report the situation
What to notice
- Reset message you did not request
- Threat of immediate account closure
- Sign-in page hosted on an unfamiliar domain
- Request for current password or MFA code
- Sender address does not match the service
- Unexpected attachment containing reset instructions
What to do
- Go directly to the official service
- Check recent sign-in activity
- Change the password only from account settings
- Never share an MFA code
- Report the message
- Contact IT through a known channel if access is genuinely affected
Frequently asked questions
What if the reset email looks genuine?
Open the service independently and check notifications there.
Will a legitimate support team ask for my current password?
No.
What if I already entered my password?
Change it immediately from a trusted device and notify security.