When you force a password or key reset, tell customers why in one plain sentence, what they must do, how to do it safely without clicking an email link if they prefer, and how to reach support. Send from your normal address, keep the tone calm and prepare support first, because resets generate a surge of tickets.
Why this message is risky
A reset email looks exactly like a phishing email. Attackers send lookalikes within hours of any public incident. If your message teaches customers to click and enter a password, you are training them for the next attack.
Wording checklist
- One sentence of reason. "We are resetting passwords as a precaution after a security issue." Be accurate. Do not claim a precaution if you know accounts were taken.
- One clear action. What to do and by when.
- A safe path. Tell customers they can go to your site directly by typing the address, not through the email link.
- What you will never do. For example, never ask for the password by email or phone.
- Where to get help, with hours.
- Related steps. Rotate API keys, review active sessions, check reuse on other sites.
Technical readiness
- Invalidate sessions and tokens at the same moment as the reset, or the reset achieves little.
- Throttle the reset flow so it does not become an attack surface.
- Check email deliverability: sender authentication must be in place so your message lands and is hard to spoof.
- Offer stronger sign in at the same time, such as multi factor authentication, but keep the reset itself simple.
- Test the whole path with a real account from a clean device.
Support readiness
Prepare a script, answers to the ten common questions in ten customer questions to prepare for, and an escalation route for locked out customers. Add temporary staffing for the first two days.
Stagger if you must
Sending to everyone at once can overload support and mail systems. If the risk allows, send in waves ordered by exposure.
After the reset
Watch failed logins and reset requests for abuse, post a short follow up when the work is complete, and review what the incident taught you about your authentication design.
Quick check
Should the email include a reset link?
Many teams avoid it and tell customers to go to the site directly. Pick one approach and say it clearly.
Do we reset everyone or only affected accounts?
Base it on evidence of exposure. When you cannot separate the groups, reset all.
Last reviewed: 19 October 2026.
