How to spot real Instagram password reset email

Instagram users were startled over the weekend after receiving unexpected password reset emails that appeared to come from the platform. Many feared phishing, but Instagram confirmed the emails were caused by a bug and that no accounts were affected. The company advised users to simply delete the messages.

The issue occurred when an external party was able to trigger reset emails without affecting account security. Instagram said it had fixed the bug and reassured users that their accounts remained safe.

How to check if an email is real

Experts recommend looking for common phishing signs. Legitimate Instagram emails will be from security@mail.instagram.com. Links should target Instagram domains. Users may mouse over the link without clicking through. The Weekend emails targeted the usual population of Instagram users. They passed the sniff test regarding logos, footers, and the absence of spelling mistakes.

Normally, the accounts would provide access to the last emails under Account Settings > Accounts Center > Password and Security > Recent Emails. However, the messages from this weekend were absent within this area and seemed fishy as a result.

What users should do

The best course of action is not to pay any attention to this email at all. Even if a user clicks a reset link, the worst-case scenario is a password change. Nothing else of security significance came from this issue that was noticed or announced by Instagram; it only stated that no action needs to be taken if any strange activity is detected on one’s account.