Password recovery through the official route

A password-reset link or code can give someone the ability to change access to an account. Treat it as private even if it is not labelled a password. Begin the request through the official login route rather than a message arriving unexpectedly. The contact address on record determines where recovery information is sent.

If the message does not arrive, inspect the address used and the account’s instructions, including spam folders where appropriate. Several rapid requests can invalidate earlier links or leave you unsure which one is current. Use the most recent valid request under the service’s guidance rather than opening every message.

Reach the official login page through a trusted route and choose its recovery option. A message arriving without your request is not a reason to click. If you did not start a reset, inspect the account through the official destination and review any security notices there.

Confirm the destination before entering a new password. Recovery links can expire or be superseded by a later request; repeated requests can make it unclear which message applies. Do not forward a reset link or let another person choose the new password for you.

Choose a unique password and update the saved entry for the correct origin. Where the service offers a session review or sign-out option, examine existing sessions and remove those you do not recognise. A password change does not necessarily revoke every separate token or session, so the service’s available controls matter.

If you suspect someone else initiated recovery, review the account and its contact details through the trusted destination. A lost second factor needs its own recovery route. Support may need an account reference to identify the issue, but the new password, reset link and recovery codes should remain private.