I just happened to check my emails and noticed that I had an email telling me that I had asked for my Live.com account password to be reset. I had not done this so I followed the link that confirmed that this was not me. About two minutes later, I received an email from Facebook stating that I had attempted to change my password and was this me? I immediately clicked on the link to report that it wasn’t the case. What I’m wondering is if there’s any way of finding out how this happened, the location of who and what was behind this? I checked my session data in Facebook and there were no strange locations there but then they have failed to login so I suppose there wouldn’t be. Is anything else of mine at risk? I’ve checked my bank statement tonight and I am a little worried.
To answer your question, no. If no one has actually logged into your account, you can’t get the information that you’re looking for; at least not without a warrant. But I do want to talk about what may have happened in order for you to get that password reset email, and what I would have you do differently in the future.
Become a Patron of Ask Leo! and go ad-free!
Unexpected password resets
If you get a password reset email without asking for one, that probably means that someone entered your login ID into a login page and said “I forgot my password”. This person clicked on the “I forgot my password” link or the account recovery link, or whatever that particular service happens to provide for people who forget their password.
Alternately, the email could simply be spam.
So if it’s not you asking for the reset then you should absolutely not do anything with the message. And that includes the one thing I’d have you do differently: Do not click on links in the email since the email itself might be a forgery or a phishing attempt!
Since you’re seeing this happen first on one account and then on another in fairly quick succession, it appears that someone’s targeting your user ID. They’re trying to see if your security is low and if they can somehow break into your account. Perhaps they’re looking to see, for example, if you have security questions that are weak or easy to guess the answer to.
In theory, there’s no way that this approach could actually work. Hotmail and Facebook are doing the right thing by using the information in your account to confirm with you before they do anything. (I say “in theory” because your security relies both on your having set up the correct information and the service provider doing the right thing).
The bottom line is that it’s important to set all of your security information up and keep that information up to date. The kinds of things I’m talking about are:
- Secret questions and answers that nobody could ever guess.
- Making sure you have an alternate email address on record and that you always have access to that other email address.
- Setting up a mobile or other phone number to which text messages might be sent for security purposes.
- Providing whatever other kinds of backup information that service uses to help protect your account.
Not only does having those things set up help prevent hackers from getting in in the first place; they are also the basis for account recovery should you ever lose your account for any reason.
Ultimately, even if your account is actually hacked, the information of who did it or how or why is rarely, if ever, made available. However if it becomes part of an investigation, it can be made available to the police.