2026: What Should Parents Do If Their Child Gets a Password Reset Email They Didn't Request?

The FTC says people reported losing more than $12.5 billion to fraud in 2024, a figure cited in its alert on protecting yourself from phishing scams. For a child’s unexpected password reset email, the immediate action is still simple: don’t click the email link or share a code; check the account through the platform’s official app or website. A reset request alone does not prove the password changed.

When the message arrives: pause and verify the account outside the email.
This week: agree on a family rule that reset links and verification codes are never shared with anyone.

This guide is for parents managing children’s game, learning, or interest accounts. It also helps when a parent monitors the family inbox because a child is not yet comfortable handling account security.

If a link was opened or information was entered, the response depends on exactly what happened. The steps below separate those cases instead of treating every unexpected email as proof of an account takeover.

A reset request is not the same as a completed password change

First identify what the message says. A request to reset a password and a notice that the password has already changed are different events. The email’s subject line does not establish who made the request, and a reset message by itself does not establish that anyone accessed the account.

Did the child recently request a reset?

Ask the child calmly whether they started a password recovery process. They may have used the platform’s official sign-in page on another device, or asked a parent to help. Check the platform’s official app or enter its known website address manually. If a reset is genuinely needed, continue from there rather than using a link in an unexpected message.

If the child did not request it, leave the link alone while checking the account status independently. Don’t forward a reset link to another family member as a way to ask them to inspect it. The link may provide access to a sensitive account action.

Could someone have mistyped the email address?

For Google password-assistance messages specifically, Google says an unrequested message may happen if someone entered the wrong email address. That explanation applies to those Google messages; it is not a rule for every platform or a guarantee that an account is unaffected. Google’s account help page explains this platform-specific case.

Look for a clear account change through the platform’s official channel: can the child sign in, and do the account’s contact details and security settings still look right? A message that merely invites a reset does not answer those questions. We don’t infer who triggered a request from the sender name or the child’s inbox alone.

The child didn’t request a reset, but the email only asks to reset

When only a reset request appears, don’t change the password automatically just because the message arrived. First check the account using the platform’s official app or a website address found independently. If the child can sign in and the account details are unchanged, there may be no confirmed account change to recover from.

That still doesn’t mean the message should be followed. Don’t click its link to “see where it goes,” reply to the sender, or use contact details included in the message. If the platform provides a security or recovery page, open it independently and follow its instructions there.

A few checks help distinguish a routine request from a message that needs more scrutiny:

• Compare the message with the platform’s official security guidance, not just its logo or display name.
• Check whether it asks for a password, verification code, payment, or other sensitive information. Treat those requests as a reason to stop and verify independently.
• Check the account itself through its official sign-in route. The message’s wording alone cannot confirm whether the account was accessed.
• If the platform offers a way to report suspicious messages, use its official reporting route rather than replying.

The FTC recommends verifying unexpected messages through contact information found independently, rather than through links or phone numbers supplied in the message. Its guidance on recognizing and avoiding phishing scams also advises against opening links or attachments in suspicious messages.

The message says the password changed, or the child can’t sign in

Treat a message claiming that the password or account details changed differently from an invitation to reset. Don’t use the email’s recovery link as the first step. Open the platform’s official app or enter its known website address manually, then check whether the child can sign in and whether the account’s recovery details have changed.

If the child cannot sign in, or the account shows an unfamiliar change, use the platform’s official account recovery process. Follow its instructions for proving ownership and securing the account. If the platform offers an official security contact or reporting channel, find it independently. Don’t use a phone number, email address, or chat link supplied in the suspicious message.

A practical comparison helps decide what to do next:

The FTC’s advice for people whose account information may have been exposed supports acting through the affected service’s official channels and taking steps to protect accounts. Don’t label every reset request a compromise; do act promptly if the account itself shows a change or access is lost.

The message asks for a password or code

A legitimate-looking logo or familiar account name is not enough to trust an email. The FTC advises people to avoid links and attachments in unexpected messages and to verify the sender through a channel they find independently. That matters especially when a message asks for a password, a verification code, or other sensitive details.

A reset link is not a code to pass to another person. Neither is a one-time verification code. If a child is asked to read one aloud, send it in a chat, or type it into a page reached from an unfamiliar email, stop and check the request through the platform’s official app or website. Don’t reply to the email or use its contact information to verify itself.

Parents can make the check less confusing by looking at the message together without opening its links. Check whether the message is about a reset request or a confirmed change, and whether the platform’s official account page shows anything unusual. If the message is suspicious, use the platform’s official reporting option, if available.

The link was opened or information was entered

Opening a message, clicking a link, entering a password, sharing a code, and downloading an attachment are not the same action. Work out what happened before choosing the next step. That makes the response more useful than assuming that every click had the same effect.

Use this checklist with the child or the adult who manages the family inbox:

• [ ] Only opened the email: Don’t use its links. Check the account through the official app or website. Opening the message alone does not show that account details were changed.
• [ ] Clicked a link, but entered nothing: Close the page. Don’t download anything or continue the process. Open the platform independently and check the account status.
• [ ] Entered the account password: Go to the platform through its official route and change the affected password. If the same password is used elsewhere, change it on those accounts too. The FTC advises taking action through the affected service if account information was exposed.
• [ ] Shared a verification code: Contact the platform through its independently found official channel and follow its account recovery or security instructions. Don’t send another code in response to a follow-up message.
• [ ] Downloaded an attachment: Don’t open it. If it was already opened, tell the adult responsible for the device and follow trusted device-security guidance; don’t rely on instructions inside the email.
• [ ] Can’t sign in or see changed recovery details: Start the platform’s official recovery process. Don’t keep trying links from the email.

If a password was entered on a page reached through the message, treat that credential as exposed even if the page looked convincing. Start with the affected account, then check other accounts that reuse the same password. If the child’s account is still accessible, review its recovery email and other security details through the platform’s official settings.

A family rule should cover recovery as well as registration

Agree on one simple routine: stop, tell a parent, and verify through the official app or website. A reset email is never a reason to give someone a password or code. This works whether a parent controls the inbox, a child reads the email, or an account is shared across a family device.

For accounts that need ongoing recovery, use an address the family can continue to access. A temporary inbox may suit a low-continuity registration that does not need future recovery, but it should not replace a child’s long-term recovery email or the platform’s security settings. Our guide to choosing an email address for an account can help clarify that distinction. For broader registration decisions, use the signup privacy checkup to consider what information a platform asks for before creating an account.

For a one-off, low-continuity signup, FwdTmp may be an option for receiving a message without putting the family’s main inbox on that registration. It is not an anti-phishing measure and cannot secure or recover a child’s account. Keep the child’s long-term recovery address on accounts that matter. When a temporary address is being considered, check the terms and limits of temporary email use first.