For about a week, I've received around five email notifications saying someone tried to reset the password for an Instagram account I barely use. The messages arrived at unusual hours, like 2 a.m. or 5 a.m. I'm not sure whether this is a bot, someone targeting me, or a sign that my email was exposed. What should I do to stop the attempts, and should I change the email address connected to the account?
2 Answers
This is often caused by automated bots trying addresses from leaked databases, so it may not be personal. Change your password to a long, unique one and enable two-factor authentication, preferably with an authenticator app rather than SMS. Also, don’t use links in unexpected emails—open the app directly and check its security settings. Changing your account email may reduce unwanted messages, but it won’t necessarily stop someone from attempting resets if they know the username.
Be cautious about assuming every notification proves someone is trying to hack you. Some messages can be phishing attempts designed to make you click a fake reset link or reveal your login details. Check the sender and the account’s official security activity from inside the app, then secure the account using a unique password and two-factor authentication. If the emails continue, mark suspicious ones as phishing and avoid responding to them.
How can I tell whether my email was leaked, and would switching the email on the account actually prevent these attempts?