Facebook Password Reset Email You Didn't Request?

An email lands in your inbox saying someone asked to reset your Facebook password. You did not ask. Maybe it is the third one this week, and each one carries a code or a big button to reset your password.

Most of the time this is not a hack. A reset email on its own does not mean your password has changed, and Facebook says to secure the account straight away only if a second email says your password was reset. Your job is to check the email is genuine, leave the link alone, and tighten two settings if anything looks off.

This guide shows how to tell a real reset email from a phishing copy, what each kind of email means, when to act straight away, and the mistakes that turn a harmless email into a lost account.

Last checked: 19 October 2026.

#Why Did I Get a Facebook Password Reset Email I Didn't Request?

Facebook's own explanation is simple. Its page on someone trying to reset your password says it is likely that someone accidentally entered your email address or username when trying to log in to their own account, and that this happens more often with popular usernames and email addresses. The same page says not to click any links to reset your password unless you made the request.

There is a second, less innocent reason. Someone may be testing whether your email belongs to a Facebook account, or hoping you will read the code out to them later. That is why the code matters more than the email. A request on its own does not change your password, so keep the code to yourself.

#Quick Answer

If you did not ask for a Facebook password reset, do not click the link or share the code. Open Facebook yourself and check Recent emails to confirm the message is genuine. If it is real and nothing else has changed, you can use the "let us know" link in the email, which Facebook says turns off password resets for your username, then change your password and turn on two-factor authentication. If a second email says your password or email was changed, treat it as a hack and go to facebook.com/hacked.

#Is the Email Really From Facebook? A Four-Point Check

Phishing emails copy Facebook's reset message closely, because people expect it. Facebook's page on checking whether an email is really from Facebook gives the tests. Run them in this order.

1. Look at the full sender address, not just the name. Facebook says its emails come only from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com, metamail.com or global.metamail.com, or their subdomains. Watch for misspelt versions of these.
2. If you use Gmail, Yahoo Mail or Apple Mail, check for the Facebook logo next to the sender. Facebook says you can trust the email when the logo appears alongside its address.
3. Open Facebook in the app or by typing facebook.com yourself. Go to Settings and privacy, Settings, Accounts Centre, Password and security, then Recent emails under Security checks. You can also type facebook.com/recent_emails/security. Facebook says some accounts now show Meta Account settings in place of Accounts Centre, so the labels may differ.
4. Look for the same email in the Security tab. Facebook says that tab shows security emails such as password change requests from the last year. If the email you received is not there, treat it as suspicious: do not use its links, and report it to phish@fb.com, which Facebook lists for suspicious emails.

One detail trips people up. Facebook says that when an email contains a special link or a security code, it may hide that part in Recent emails to protect the account. So a matching entry with the code hidden is normal, and you will need access to your email inbox to see the full message.

#What Each Email Means and What to Do

The emails around a reset request tell you how worried to be. Use the table to match what you received with the right response.

The fourth row comes straight from Facebook: its reset page says that if you receive a second email saying your password has been reset, you should secure your account immediately. If that has already happened, our guide to a Facebook account where the email and phone were changed walks through the next steps.

#Can Someone Hack My Account With a Reset Request?

Not by the request alone, as long as the code or link stays with you. The risk comes if they also get the code from you, get into your email, or already know your password.

That gives you a clear list of what to protect:

• The code itself. No genuine helper, friend or Meta employee needs it.
• Your email account. Whoever controls the inbox can reset Facebook. Give it a strong unique password and its own two-step verification.
• Your phone number. If your phone suddenly shows no service, call your mobile carrier and ask whether your SIM was replaced or moved.
• Your Facebook password. If you reuse it elsewhere, change it now, because passwords leaked from other sites can be tried on Facebook.

#What to Do Next, Step by Step

These steps are quick and cover both the harmless and the not so harmless explanation.

1. Leave the email alone. Do not tap the reset button or reply.
2. Confirm the email is genuine using the Recent emails check above.
3. If it is genuine and you want the requests to stop, Facebook's reset page says you can turn off password resets for your username by clicking the "let us know" link in the reset email. Only use that link from an email you have confirmed in Recent emails.
4. Change your Facebook password from inside the app or website if the password is old, reused or shared.
5. Turn on two-factor authentication. Facebook's two-factor authentication page lists three methods: a security key, codes from an authentication app, or text message codes. It also lets you get 10 recovery login codes for when your phone is not available.
6. Check where you are logged in. Facebook's page on logging out of other devices shows the Where you're logged in list in Accounts Centre, with a date, time, location and device type for each session. Log out of anything you do not recognise.
7. Check the email address and phone number on the account are still yours.

If you spot a login you do not recognise during step 6, the problem is bigger than a stray reset email. Our guide to what to do when someone logged into your account covers that situation.

#Mistakes That Turn a Harmless Email Into a Lost Account

• Clicking the reset link out of curiosity and then typing your password into the page it opens.
• Reading the code to someone who calls or messages claiming to be from Meta, a bank or a courier.
• Forwarding the email to a friend or a so-called recovery helper who then uses the code.
• Ignoring a second email that says your password or email was changed.
• Keeping the same password on Facebook and your email account.

#If You Already Clicked the Link or Shared the Code

Move quickly but in order. Change your Facebook password from inside the app, then change your email password, then log out of unknown sessions. If you can no longer log in, go to facebook.com/hacked from a device you have used before. If you typed your password into a page that a link opened, our guide to what to do after clicking a phishing link lists the clean-up steps.

In Malaysia, if money was lost, for example because the attacker then asked your friends for a loan, call the National Scam Response Centre on 997. The official NSRC 997 page says the line runs 24 hours and asks victims to call within 24 hours of discovering the scam, then contact the bank and make a police report. For a phishing email or fake login page with no money lost, CyberSecurity Malaysia's Cyber999 service takes incident reports by online form, email, phone or its mobile app.

#When a Case Review Makes Sense

A single reset email needs no outside help. A review makes sense when the emails were followed by a real change, such as a new email address on the account, a password you did not set, or friends receiving messages you did not send, and the official route has not worked. SocialSafe by AwareXone, the recovery service of AwareXone, looks at what you have tried and tells you honestly whether an official route is still open. Our Facebook account recovery service explains how that works, and our Trust Center sets out what we never ask for, starting with your password and login codes.

#Frequently Asked Questions