Alerts can be genuine
Services may warn about a new login, password reset, recovery change, payment, device or unusual activity.
Technology, platforms and channels
Is this account-security message genuine?
A security alert may describe a real sign-in, an automated precaution or a false emergency designed to capture access. The message itself should not become the route used to authenticate the claim.
Page S-012Guidance pageReviewed 29 August 2026
Key Guidance
Do not sign in, approve a request or call a number through the message. Open the service independently and check its security activity, sessions and notifications. If the event appears there, follow the provider's own recovery process. If it does not, preserve and report the suspicious contact.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
A genuine alert and a phishing message can use similar language. The difference is confirmed inside the account or through an independently reached provider—not by how polished or urgent the message appears.
Criminals copy familiar warnings
A false alert can imitate branding and security language to create an urgent reason to click, call or disclose a code.
The requested route matters
A genuine-looking notice becomes dangerous when it directs you to a copied sign-in page, an unknown number or an unexpected approval request.
Account evidence is stronger
Recognised sessions, recent activity, sent messages, recovery details and provider notifications show whether something actually changed.
Consequences and movement
What may happen next
Separate the message from the account. Use a device, app, bookmark or address you already trust to confirm which of these situations applies.
No matching event appears
Do not interact with the supplied route. Preserve the message and use the channel's reporting controls.
A genuine event was mine
No recovery may be needed, but review why the alert appeared and keep stronger sign-in protection enabled.
An event was not mine
Use the provider's recovery process, check email rules and recovery details, change reused passwords and end unfamiliar sessions.
I approved, signed in or shared a code
Treat the account as potentially accessed even if nothing looks different yet. Secure email and the affected account at once.
Practical response
What you should do
Protect the real account without allowing the incoming message to control the investigation or recovery route.
- Open the service independentlyUse its genuine app, a saved bookmark or an address you type yourself. Do not use the message's link, attachment, number or search advert.
- Check activity and security settingsReview logins, devices, sessions, sent messages, payments, forwarding rules, recovery contacts and recent changes.
- Recover through the providerIf access or settings changed, use the provider's published recovery pages and secure the email account that controls resets.
- Replace exposed credentialsChange the affected password and every reused copy. Prefer a passkey where available or enable two-step verification.
- End unfamiliar accessSign out other devices and revoke unknown apps or sessions so an old session cannot remain active after a password change.
- Escalate the consequenceContact the bank for unauthorised payments, an employer's IT team for a work account, and the appropriate reporting route for fraud or loss.
Look more closely
Check security warnings inside the genuine account
A warning may describe real activity or create a false emergency. Open the service independently and review its security records there instead of signing in, calling or approving through the message.
An unexpected alert reaches the account holder.
Fear of losing access or money creates urgency.
Branding and security language imitate the provider.
A sign-in page, number or approval request directs action.
The user opens the real account independently.
Selected history
Historical cases and lasting lessons
Evidence of unauthorised account activity
Official cyber guidance identifies unfamiliar logins, changed security settings, unknown messages and unauthorised purchases as signs that an account may have been accessed.
Lasting lesson: A warning is a prompt to inspect the account. Visible account changes are stronger evidence than the message alone.
Action follows what was disclosed
Official guidance separates responses for bank details, passwords, compromised accounts, software installation and financial loss.
Lasting lesson: The effect—not simply receiving the message—determines the urgent response.
Transferable understanding
Patterns over time
Urgency discourages independent access
The message suggests that delay will lock the account, lose money or allow an attacker to continue.
The alert may describe the action it causes
A false password-reset or login warning can lead the recipient to enter the very sign-in details the criminal needs.
A code can be presented as cancellation
The sender may claim that reading out or entering a security code will stop an event when it may actually approve access.
Email is often the control account
Access to email can support password resets and conceal activity through forwarding or filter changes.
Plain-language answers
Common questions
Does a real logo mean the message is genuine?
No. Logos, sender names and copied layouts can be reproduced. Check the claim inside the independently opened account.
What if the message contains my real name?
Accurate personal information can come from earlier contact, public sources or exposed data. It does not authenticate the current sender.
Should I change my password whenever I receive an alert?
Change it when it was disclosed, reused or there is evidence of access. Inspect activity first when the alert alone is the only signal.
Can I safely reply and ask whether it is genuine?
A reply returns to the same unconfirmed sender. Use the provider's app, account or official support route instead.
Check the account without following the alert
Open the genuine service, inspect its records and use its recovery process if something changed. Match further action to access, information, software or money involved.
Scamology Insights
Notice when protection language transfers control
These learning resources can help you tell the difference between a useful account warning and a false message that directs you away from the real account. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency