iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A password-reset email can look legitimate while its link leads somewhere unsafe. Don’t use the link to decide whether the message is real: open the service through a bookmark or an address you already know, then check your account there. If you entered a password or one-time code on the linked page, treat it as exposed and act through the service’s official site.
Why a real-looking reset email can lead to a fake destination
The message and the webpage are separate things. A familiar logo or convincing notification does not authenticate the link’s destination: phishing pages can imitate financial or payroll login sites, and lookalike addresses or redirects can obscure where a link goes. The FBI’s Account Takeover Fraud guidance describes phishing, fraudulent websites, and social engineering as ways criminals obtain account access.
In a November 25, 2025 public service announcement, the FBI and IC3 described a financial-institution support impersonation scheme in which criminals obtain credentials and a multi-factor authentication (MFA) or one-time passcode, sign in to the legitimate institution, and initiate a password reset. The announcement reported more than 5,100 account-takeover complaints and losses exceeding $262 million since January 2025. Those figures cover the period and complaint category described in that announcement; they are not a current-year total. The mechanism does not establish what happened with any particular email.
Free tools Windows power users keep installed
One-click scans. No signup required.
An unexpected reset notice alone does not prove that an account was taken over. A compromised email inbox is especially important to secure, however: someone with inbox access may request reset links for other accounts and retrieve them there. The FTC explains this risk in How To Recover Your Hacked Email or Social Media Account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What to do, based on what happened
| What happened | What to do next |
|---|---|
| You received the email but did not click | Leave the link alone. Open the service independently and check account activity or security notices there. |
| You opened the link but entered nothing | Close the page, don’t interact further, and update your security software and run a scan, as the FTC advises for suspicious links. |
| You entered a password or one-time code | Use the known-good official site to change the exposed password. Change it anywhere else you reused it, sign out other sessions if possible, and turn on MFA if available. |
| You can’t sign in, or see financial activity you didn’t authorize | Start the provider’s official account-recovery process. Contact the financial institution promptly through a known channel if money, transfers, or direct deposits are involved. |
These are response steps, not a diagnosis: the email and its redirect chain would need to be examined to determine what happened in a specific case.
Verify the account without using the email link
- Stop interacting with the message. Don’t click again, reply, call a number in it, or enter credentials or a code on the page. The FTC warns that even opening an unexpected link can expose you to scammers, even if you enter no sensitive information; see Don’t take the bait on phishing scams.
- Go to the service independently. Use a saved bookmark or type an address you already know is correct. Check security alerts and recent account activity after signing in.
- Contact support only through a known route. If you’re unsure, use the provider’s official website or a phone number you already trust—not contact details in the message or a search advertisement. The FTC gives this advice in Phishing scams can be hard to spot.
MFA is worth enabling where available, but it does not make a fraudulent sign-in page safe. The FBI puts it plainly: “Multi-factor authentication will not protect you if you land on a fraudulent login page.”
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If you entered your password or a code
- Change the exposed password through the official service. Choose a unique password that you do not use on another account. If you reused it, change it on those services too.
- End other sessions. Use the service’s sign-out-all-devices or session-management control if it offers one.
- Review account security details. Check recovery email addresses and phone numbers, recent sign-ins, sent and deleted mail, and email-forwarding rules. Remove recovery details or forwarding rules you did not add.
- Enable MFA if available. Never give a one-time code to a caller or someone claiming to be support.
- Secure your email account as well. If the affected account is your inbox—or you suspect someone else has inbox access—follow the provider’s official recovery steps and check for changes that could let someone keep access or capture other accounts’ reset messages.
The FTC’s account recovery guidance includes official recovery entry points for major email and social platforms.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If you clicked, lost access, or noticed fraud
- After clicking: update your device’s security software and run a scan, following the FTC’s phishing guidance.
- If locked out: start recovery from the provider’s official website, reached independently. Don’t pay someone who contacts you unexpectedly and claims they can restore access.
- If a financial account or transfer is affected: contact the institution promptly using its known official channel. The FBI/IC3 advises reporting account takeover and relevant fraudulent transfers.
- If personal information or money was exposed: report phishing to the FTC and use the appropriate official identity-theft or cybercrime reporting route. Use contact details from official government websites, not the suspicious message.
Can you tell from the email whether it was really sent by the provider?
Not from the scenario alone. A convincing message and a destination that looks wrong are reasons to stop and verify, but they do not prove whether the provider sent the notification, whether the link was altered or redirected, or whether an account was accessed. Determining that would require examining the original message, its headers, the full link and redirect chain, and the provider involved. You can still protect yourself without resolving that question first: verify through a known route and use the official recovery process if needed.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
