Check a Password Reset Email for Spoofing

A password reset email can look routine: a familiar service name, a neat logo and a request to open a link before an account is locked. Attackers copy those cues to create urgency. Treat every unsolicited reset as a possible phishing attempt, especially one containing a short-lived link or unexpected sign-in prompt.

Before investigating the link, pause and inspect the sender. Trusted Sender Score gives individuals and IT teams a free way to check email sender and domain trust through reputation checks, DKIM and DMARC analysis, and anti-spoofing guidance. Its findings are evidence for a decision, not an automatic verdict.

For Australians, convincing decoys may imitate a major bank, the Australian Taxation Office, My Health Record or a workplace email account. Familiar suffixes such as .gov.au and .com.au help narrow the origin, but a close variant can still deceive. Sydney and Melbourne offices receive the same convincing templates as small regional businesses.

The practical task is checking whether a password reset email is genuine or spoofed without clicking the embedded link. Compare the visible sender, domain records, authentication results and the service's expected behaviour. If those signals conflict, open the service independently and decide there.

Start with the exact sending domain

Read the complete From address rather than the display name, because a sender label can conceal an unrelated domain. On a phone, long-press the message or open its details to reveal the address. Also check Reply-To, which may differ from the visible sender, and note the registrable domain and any subdomain separately.

A convincing replacement can add a word, hyphen, extra letter or unrelated subdomain to a familiar name. The link target may expose another domain even when the message appears to come from a legitimate address. Login pages for Australian banking, government and retail accounts often look familiar, so visual polish is weak evidence.

Check reputation before authentication

Enter the sending domain into Trusted Sender Score and review its sender and domain trust report, including any available phishing, spoofing or configuration warnings. A clean report does not certify every email from that domain, while a warning gives a reason to stop and verify before entering credentials or authorising a reset.

For an organisation with many staff and customer-facing domains, the platform's bulk domain checking can reveal inconsistent mail security. Developer tools and the API can add trust verification to onboarding, procurement or support workflows. Those uses reduce manual checks, but each result still needs context.

Read SPF, DKIM and DMARC together

SPF lists servers permitted to send mail for a domain. DKIM signs outgoing messages so recipients can verify integrity, while DMARC states how failures should be handled and whether the visible From domain aligns with the authenticated domain. A domain may publish all three records yet still be misused if an authorised sending service is compromised.

Key strength matters as well as record presence. The guide to weak DKIM key risks explains why a short cryptographic key can make forged messages easier to produce. A valid-looking DKIM entry should therefore be assessed for key length and signing configuration, not treated as proof simply because the DNS record resolves.

Alignment links the authentication result to the domain shown to the user. SPF or DKIM can pass while the authenticated domain belongs to a sending platform, and DMARC may fail if the visible sender does not align with that domain. Conversely, a missing or imperfect record is a warning to verify, not conclusive proof of malicious intent.

Compare headers with the visible message

Where the mail client exposes them, inspect the raw headers for From, Reply-To, Return-Path, Received and Authentication-Results. The visible message can be copied while the technical path tells a different story. The domain spoofing attack review explains how a legitimate domain might be impersonated across a customer base.

Headers also reveal where the message actually travelled and which checks passed, failed or were skipped. Forwarded mail and some legitimate mailing systems can alter authentication chains, so explain anomalies rather than treating every mismatch as fraud. Combine technical evidence with the reason the reset was sent and the service's normal process.

Verify the request outside the message

Open the provider's app, type its known website address or use a saved bookmark rather than the emailed link. Many Australians manage banking, workplace and health accounts on phones, so check recent password changes, active sessions and recovery details in the app. If no reset was requested, lock the account where possible.

Use a unique password stored in a password manager and keep multi-factor authentication enabled. Contact the provider through its official site or a trusted support number if the message is unexpected. A legitimate reset should match activity you initiated; an unexplained request should be treated as hostile until verified.

Contain harm and preserve evidence

Do not click, reply or download anything from a suspicious message. Record the sender, time, link destination and visible claims, then report it to the mail provider and the impersonated organisation. If a link was opened but nothing was entered, close it and still report the attempt because a redirect or tracking pixel may have confirmed access.

If credentials or a one-time code were entered, change the password through the genuine service, revoke active sessions, re-register trusted devices and alert the relevant bank or provider. Scam emails can imitate Australian financial institutions, so use the number on the back of a card or in the official app rather than a number in the message.

Australian organisations must also assess incidents under the Privacy Act 1988 and the Australian Privacy Principles. Eligible data breaches may require notification to affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, with details varying by the incident and statutory thresholds. Keeping evidence supports a prompt, accurate assessment rather than a vague internal assumption of harm.