Member Authentication E-mail - (But, member did not request password reset)

Hello all,

Club 4260 here. Our Club president received a password reset email with link, and as the Website Administrator, I also received the standard informational email. However, the president is saying that she has not requested a password reset. Any ideas what's going on here? Apparently, this happened last week as well.

p.s. Sorry if this question has been answered - a forum search turned up nothing, or my coffee hasn't kicked in yet .

Regards,

It usually means someone has tried entering her name and doing a password reset request. The authorisation goes to her email address, so the other person wouldn't be able to access it.

I've just tried pressing the authorise button with no name entered for my club, and it seems a request has gone to one of our members. This is probably the more likely scenario (easy to accidently press the login button before putting in your details). I'll ask our programmer if he can prevent that from happening.

Anyway - nothing to be concerned about, but thank you for letting us know.

Thank you for your quick response, Pam.

Have a lovely day!

Hi Pam,

There is a member of my club who also received a member Authentication E-mail without requesting a password reset. They swear that they did not hit Authenticate on accident without first entering their password. This member is concerned that someone is phishing their email. Since anyone could have put this persons email into our sites login with this persons name and hit authenticate how can one tell if they are being phished or not? I did notice that the email came from server@toastmastersclubs.org. Could someone be disguising their sent email as server@toastmastersclubs.org? Please let me know if you can help. Thanks, Svancara

Hi Pam,

I enclosed a copy of the email our member received.
Thanks,
Svancara

Club 932047
projectmasters.toastmastersclubs.org

That appears to be a genuine email. As you have noted, anyone could have triggered it - probably a genuine error.

If the member didn't request a password reset he/she should just ignore/delete the email. If they feel the need, they can go to the site and do a genuine reset request to change their password. The authentication link only goes to the member. Depending on the site settings, a copy of the email could go to the site admin.

Something else you can do is set up an antispoofing phrase known only to your members - see the bottom section of this document: support.toastmastersclubs.org/doc/item/email-and-contact-forms