8

An email claiming to be from facebook had the following content:

Hi Andrew, You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to reset your password a few days ago. This is a reminder that you can log back into your account at any time by clicking this link and entering in a new Facebook password.

If you have any other questions, please visit our Help Center. Thanks, The Facebook Team

The link was

<a href="https://www.facebook.com/recover.php?n=[redacted] "color:#3b5998;text-decoration:none;">this link</a>

Is this a genuine email from Facebook that is ridiculously prone to abuse ("Can't remember what I did a few days ago - I'd better click that link!"), or a phishing email that's managed to guess my first name?

Andrei Botalov
  • 5,397
  • 11
  • 49
  • 74
Andrew Grimm
  • 2,102
  • 2
  • 20
  • 27
  • 2
    Either way, you should really be asking Facebook, so they can either try to thwart the phishing or improve their messaging. The link you posted has quoting problems, but that may be a combination of MIME/quoted-printable and your redaction; otherwise it looks legit. – Major Major Jun 10 '12 at 03:21

4 Answers4

6

A simple way to check is just to get them to send another password reset and see what the links used for password recovery are, it would also be useful if you checked your emails and see if you did request one a few days ago, or check the trash folder if you deleted it. Here's the reset email they sent me:

> Hi ****,
> 
> You recently asked to reset your Facebook password. To complete your
> request, please follow this link:
> 
> https://www.facebook.com/recover.php?n=******&id=********&s=***
> 
> Alternately, you may go to https://www.facebook.com/recover.php and
> enter the following password reset code:
> 
> *******
> 
> Please note: for your protection, this email has been sent to all the
> email addresses associated with your Facebook account.
> 
> *Didn't Request This Change?* If you did not request a new password, let us know at:
> 
> https://www.facebook.com/login/recover/disavow_reset_email.php?n=******&id=*********
> 
> Thanks, The Facebook Team

The links actually point to what they say as well so it does seem Facebook use www.facebook.com/recover.php for their resets.

You can also look at the email headers, in particular the authentication results which check if the senders email actually comes from their domain, my email in Hotmail showed:

> Authentication-Results: hotmail.com; sender-id=pass (sender IP is
> 66.220.155.140)

And you can check that IP resolves to Facebook as well: https://ipdb.at/ip/66.220.155.140

Peanut
  • 1,039
  • 1
  • 8
  • 22
2

Never ever click on a link in an Email, even if it is NOT asking you to change authentication information.

In this case, the email probably does originate from Facebook. Someone has told the Facebook site you've forgotten your password. This kind of request can't be authenticated directly (hence it sends an email to the address associated with the account - and relies on the email system to handle the authentication).

symcbean
  • 18,625
  • 1
  • 41
  • 75
  • 8
    "Never"? Not even if I've legitimately forgotten my password, and was expecting the reset email? – me_and Jan 17 '13 at 13:40
1

There are a lot of people out there that believe their facebook account name is their firstname or firstnamelastname. You can ask for password reset using just the username so if you have a username that can be a common name - this might be the reason that you get an e-mail like that. It might be also that someone is trying to annoy you. like others mentioned.

I receive genuine password reset e-mails every day and facebook's help page on this is just to disregard it.

absolem
  • 11
  • 2
0

I googled that it could be one of the phising e-mail but I'm wondering why the URL leads us to the Facebook page. "Redacted" part of URL consists of digits, right?

Could you please check e-mail headers to check the authentic sender?

p____h
  • 1,557
  • 7
  • 11