Quick answer: Do not click the email links; open the service directly, verify sessions and recovery details, and secure the email account that controls resets.
Repeated resets may be a typo, credential-stuffing attempt, harassment, or preparation for account takeover, but the emails do not prove the password changed. Start with the checks below and change one thing at a time. That preserves evidence and makes it easier to reverse a change that does not help.
Why this happens
The symptom usually comes from one of several layers: the device or app, its account settings, the local connection, or the service behind it. The most useful clues are when the problem began, whether it affects another device, and whether it follows one network or account.
- Someone knows the account email and is requesting resets.
- Another user entered the wrong address.
- A leaked email/password pair is being tested automatically.
- A fake reset email is itself the phishing attempt.
Fix it in the safest order
- Open the official app or type the known domain yourself.
- Review recent sign-ins, sessions, recovery email, phone, and forwarding rules.
- Change a reused or weak password and enable strong MFA.
- Secure the email account first because it can reset many other accounts.
- Report suspicious messages and create a mail rule only after confirming it will not hide real security notices.
After each step, repeat the exact action that failed. Avoid changing several settings together; otherwise a temporary recovery can look like a permanent fix.
How to confirm the problem is fixed
Session and security pages should show only trusted activity, and no recovery detail should change without your action.
Common mistakes to avoid
- Do not use the reset link in an unexpected email.
- Do not reply to the sender.
- Do not ignore an accompanying unexpected login or MFA prompt.
FAQ
Should I change my password every time someone requests a reset?
Not if the password is unique and there is no suspicious login, but change it immediately if it is reused, weak, exposed, or the account shows unknown activity.
Will these steps erase my data?
The diagnostic steps do not require a factory reset. Back up important files and recovery codes before reinstalling an app, clearing app storage, resetting a router, or changing an account recovery method.
Related PHWhy guides
Browse the Cybersecurity guides. You may also need Check whether a login page is fake or Respond to an unexpected reset code.



