My Password Is Correct but Someone Keeps Trying to Reset It: What to Do

1. Problem

You know your password is correct, but reset emails, security alerts, or verification codes keep appearing. Sometimes the message says that someone requested a password reset. In other cases, you receive a sign-in warning even though you did not try to log in.

This can be unsettling, especially when the account continues working normally. It may feel as if someone already knows your password, but a password-reset attempt does not automatically mean the person has access to the account.

Most major online services allow anyone to enter an email address or username and request a password reset. An attacker may repeatedly trigger those requests simply because they know the account identifier.

The problem becomes more serious if you also see successful sign-ins, unfamiliar devices, changed recovery information, or password-change confirmations. Those signs suggest that someone may have gained access rather than merely attempting to reset the password.

The repeated alerts are also frustrating because changing the password alone may not stop them. If an attacker knows the email address, they can continue submitting reset requests.

2. Why It Happens

There are several reasons this can happen.

Someone knows your email address

Your email address is often enough to start a password-recovery process. It may have appeared in a data breach, public profile, old account, leaked contact list, or previous online service.

Knowing the email address does not prove that someone knows your password.

Someone is repeatedly triggering account recovery

An attacker can deliberately request password resets to annoy you, test whether an account exists, or try to trick you into revealing a verification code.

If the service sends a legitimate reset message, the attacker may not have received the actual reset link. They may simply have started the recovery process.

Your password may have been exposed elsewhere

If you have reused the same password on multiple websites, a breach at another service can put your account at risk.

This is particularly dangerous when the exposed password is still being used for your email account. Email is often the recovery route for other accounts, so protecting it should be a priority.

Your device or browser may be interfering

Saved passwords, password managers, old browser sessions, synchronized devices, and third-party applications can sometimes create confusing login activity.

An old phone or computer that still has an account connected can also continue trying to authenticate after a password change.

Security systems can produce repeated alerts

Account providers monitor unusual login attempts and recovery activity. A suspicious location, unfamiliar device, repeated failed authentication, or unusual recovery request can trigger notifications.

Software updates can also change how account security notifications are displayed, making normal security events appear more alarming than they actually are.

3. Fastest Fix

Start with the account that is receiving the reset notifications.

1. Do not use links in unexpected reset messages

If you did not request the reset, do not click the reset link just to investigate.

Instead, open the service's official website or app yourself and sign in normally.

This reduces the chance of falling for a fake password-reset message.

2. Change the password from the official account settings

Use a new password that you have never used on another website.

A strong password should be long and difficult to guess. Avoid names, birthdays, phone numbers, familiar phrases, and simple variations of your old password.

If you use a password manager, let it generate a unique password.

3. Turn on two-factor authentication

Two-factor authentication adds another barrier even if somebody discovers your password.

An authenticator app or security key is generally preferable to relying only on SMS when the service supports stronger authentication methods.

4. Check recent sign-in activity

Look for:

• Devices you do not recognize
• Unfamiliar locations
• Unknown browsers
• Successful sign-ins you did not make
• Password changes you did not authorize
• Changes to recovery email addresses or phone numbers

Do not panic over every unfamiliar location. Mobile networks, VPNs, carrier routing, and travel can make a legitimate device appear somewhere unexpected.

Look for a combination of unfamiliar device and activity you do not recognize.

5. Sign out of other sessions

If the service provides an option such as Sign out of all devices, use it when you suspect unauthorized access.

Then sign back in only on devices you trust.

This can remove old sessions that remain active after a password change.

6. Secure your email account

If the affected account uses your email for password recovery, protect the email account too.

Change its password, enable two-factor authentication, and review recovery settings and logged-in devices.

An attacker who controls your email can potentially reset passwords for many other services.

4. Advanced Methods

If the reset attempts continue, look beyond the password itself.

Review connected apps

Open your account's security or privacy settings and examine connected applications.

Remove applications you no longer use or do not recognize.

A third-party application with account access can sometimes continue operating even after you change your password, depending on the type of authorization it received.

Check account recovery information

Verify that the recovery email address and phone number belong to you.

Pay particular attention to unexpected changes. If an attacker has changed recovery information, treat the account as compromised and follow the provider's account-recovery process.

Revoke old sessions and authentication tokens

Some services allow you to manage active sessions, app passwords, trusted devices, or authentication tokens separately.

Changing a password does not always mean every previously authorized connection has been removed.

Revoke anything you do not recognize.

Check your password reuse

Think about where else you have used the same password.

If the password has been reused, change it on every important account, starting with your email, financial accounts, cloud storage, social media, and work accounts.

Do not simply add another number or symbol to the old password. Use genuinely different passwords.

Test the problem on a clean device

If you suspect the computer or phone itself is generating the activity, try accessing the account from a trusted device.

On Windows, temporarily test the account after starting the system in Safe Mode if you suspect a background application is interfering with normal operation.

On Android, Safe Mode can help identify whether a recently installed third-party application is responsible for unusual behavior.

If the suspicious activity stops only when third-party software is disabled, review recently installed applications and remove anything unnecessary or suspicious.

Check your browser and password manager

Review saved passwords and account synchronization.

Remove obsolete saved credentials and make sure your password manager is using the current password.

Also check browser extensions. An extension you no longer need should be removed, particularly if it requests access to account information.

Check whether the password reset actually succeeded

This distinction matters.

A notification saying "someone requested a password reset" is very different from "your password was changed".

If the attacker can repeatedly request resets but cannot complete them, your account may still be secure.

If you receive a notification confirming that the password, recovery email, phone number, or security settings were changed without your permission, treat it as a possible account takeover.

5. Prevention

The easiest way to reduce these problems is to make account recovery difficult for anyone except you.

Use a unique password for every important account. A password manager makes this much easier because you do not need to memorize dozens of different passwords.

Enable two-factor authentication wherever it is available, especially on your primary email account.

Keep your phone, computer, browser, and security software updated. Updates sometimes change security controls, authentication behavior, and account-management features, so review important security settings after major updates.

Remove old devices from your accounts. An unused phone, tablet, or computer should not remain trusted indefinitely.

Review connected applications periodically. If you stopped using an application, remove its account access rather than leaving the connection active.

Do not share verification codes with anyone. Legitimate support staff should not need you to read a one-time security code to them.

Be careful with password-reset messages. Attackers sometimes send fake alerts designed to make you act quickly. If you are unsure, ignore the message and open the service directly through its official app or website.

Finally, pay attention to the type of alert you receive. Repeated failed attempts are concerning, but a successful unauthorized sign-in, changed recovery information, or completed password reset requires much faster action.

6. FAQ

Why does someone keep requesting a password reset for my account?

Someone may know your email address or username and repeatedly submit it to the account recovery form. They do not necessarily know your password or have access to your account. If you are only receiving reset requests and there are no successful unfamiliar sign-ins, the requests alone do not prove that your account has been hacked.

Can someone reset my password without knowing the current password?

Usually, password recovery is specifically designed to work without knowing the current password. However, the attacker normally still needs to pass the service's verification process. Strong two-factor authentication and secure recovery information make it much harder for someone else to complete the reset.

Should I change my password if someone keeps trying to reset it?

Yes, changing the password is sensible, particularly if the password has been reused elsewhere or you suspect it may have been exposed. Create a completely new, unique password and enable two-factor authentication. Also review recent sign-ins, connected devices, recovery information, and active sessions.

Does a password reset request mean someone knows my password?

No. A person can often request a password reset simply by knowing your email address or username. The important question is whether the reset was completed or whether there are successful unauthorized sign-ins. Repeated requests are a reason to review your security settings, but they are not proof that your password is known.

Why do I keep receiving password reset emails after changing my password?

Changing the password does not prevent someone from submitting your email address to the recovery system. They can continue requesting resets even though they cannot complete them. If the emails are legitimate, you can usually ignore unsolicited requests while monitoring your account for successful sign-ins or changes you did not make.

What should I do if someone actually changed my password?

Use the service's official account-recovery process immediately. If you still have access, change the password again, sign out other sessions, restore your recovery information, enable two-factor authentication, and remove unfamiliar connected applications. If you no longer have access, use the provider's official compromised-account recovery process rather than links supplied in unexpected messages.

Can an old phone or app cause repeated login attempts?

Yes. An old device, browser session, or application can sometimes continue using outdated credentials after a password change. Review your account's active devices and connected applications, sign out old sessions, and update or remove applications that no longer need access. If the activity continues, test the account from a trusted device.

7. Summary

A repeated password-reset request does not automatically mean someone has your password. In many cases, the person only knows your email address and is repeatedly triggering the recovery system.

The safest response is to avoid unexpected reset links, change the password through the official service, use a unique password, enable two-factor authentication, review recent sign-ins, remove unfamiliar sessions and applications, and secure your primary email account.

If you see evidence that a password was actually changed, recovery information was modified, or an unfamiliar person successfully signed in, treat the situation as a potential account compromise rather than ordinary password-reset spam.

The problem remains important because account recovery systems, connected devices, synchronized applications, and security features continue to change. Knowing how to distinguish an attempted reset from an actual account takeover helps you respond to the real threat without making unnecessary changes.

FixTech fixes digital problems, restores control, simplifies systems, and makes things work.