Unasked-for Account Recovery

Unasked-for Account Recovery: a reader asks…

I received an email from Facebook that said it received a request to reset my Facebook password. It included a reset code and a link to change my password. Before I do anything, thought I’d check with you – I didn’t ask for any account recovery. Should I reset my password?

No need to panic. Firstly, anyone who knows your email address can use the forgotten password feature built into most online services to reset the password. If in fact the email did come from Facebook and is legitimate, that just means that some hacker used that feature on the Facebook login page. If you didn’t request the change, you shouldn’t take the action suggested in the email (except maybe to do so independently from the email).

Secondly, the email could be fake. Before you click on any link, hover over it to see if it points to the domain name of the company it purports to be from. Even if the From line looks legit, hackers are constantly finding new ways of spoofing email addresses (although less likely email accounts themselves).

In the email you submitted, the links all check out, this is actually from Facebook.com. Most likely, it was kicked off by some hacker’s script which tries out changing passwords on many Facebook accounts. They know that almost all of these attempts will fail, but it costs them very little to do this on a large scale, and they usually catch at least a few people who’s email accounts are compromised.

What I would suggest you do is independently log into your Facebook account and run the Security Checkup which includes changing your password. Go to your Facebook Settings, then to the Password & Security section (https://accountscenter.facebook.com/password_and_security). Change the password – make sure it’s a good and long password that you’ve not used elsewhere. If not already done, turn on two-factor authentication and login alerts (such as via the Facebook app on your smartphone and/or your primary email account). Also take a look at “Where you’re logged in” and log out of your account for any locations you’re not 100% sure are you.

Under your Personal Details, there’s also an Account Ownership and control section where you can designate someone who can deal with your Facebook account if something should happen to you. You can choose a spouse, your child, parent, whoever you want. It’s a good idea to have this so that if you die, someone can either close the account or create a memorial for you.