Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email address. Content are same, as if I had requested a password change. I have never requested for such a thing, and more strangely, I haven't even logged onto Facebook today. I am confused about what should be done next.

Source of one of such messages with PII removed:

Delivered-To: xxxxxxxxxx@xxxx.com
Received: by 10.112.127.193 with SMTP id ni1csp8990lbb;
        Wed, 15 May 2013 04:01:05 -0700 (PDT)
X-Received: by 10.49.35.132 with SMTP id h4mr32118109qej.29.1368615664824;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
Received: from mx-out.facebook.com (outmail010.ash2.facebook.com. [66.220.155.144])
        by mx.google.com with ESMTP id k3si579007qch.125.2013.05.15.04.01.04
        for <xxxx@xxxxx.com>;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates 66.220.155.144 as permitted sender) client-ip=66.220.155.144;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates 66.220.155.144 as permitted sender) smtp.mail=password+kjdmiikvhppi@facebookmail.com;
       dkim=pass header.i=@facebookmail.com;
       dmarc=pass (p=REJECT dis=none) d=facebookmail.com
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2011-q2; t=1368615663;
    bh=VxEamRxXZ6SfTLvhRMIa5Ql8ijPP2ciAPaWmEiPqZkE=;
    h=Date:To:From:Subject:MIME-Version:Content-Type;
    b=nP3TizJu9pZ3rvqTrtWU5t3pzCKSjlApuBjoloWjH/aBI/9GAqAkhARhdNhtKOhLU
     G3wm9ECZn+RwqEYh3v8PmQbhEoLnKDOMbm7LCh8o0yFrRu4uPWHzb+TBfnJUvG/SAM
     Pb/CfjAA5fqFbEuZxvBRDXOoTLYJ/H9i6uJPY3Yg=
Received: from [10.198.241.35] ([10.198.241.35:65219])
    by smout014.ash4.facebook.com (envelope-from <password+kjdmiikvhppi@facebookmail.com>)
    (ecelerity 3.6.0.37104 r(/root/Platform:develop)) with ECSTREAM
    id 6A/27-01069-FEA63915; Wed, 15 May 2013 04:01:03 -0700
X-Facebook: from zuckmail ([MTI3LjAuMC4x]) 
    by www.facebook.com with HTTP (ZuckMail);
Date: Wed, 15 May 2013 04:01:03 -0700
To: xxxxxx@xxxxx.com
From: "Facebook" <password+kjdmiikvhppi@facebookmail.com>
Reply-to: Facebook <password+kjdmiikvhppi@facebookmail.com>
Subject: You requested a new Facebook password
Message-ID: <ca2180dd82544c68dd6601660d9cc9a9@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: password+kjdmiikvhppi@facebookmail.com
X-Facebook-Notify: password_reset; mailid=
X-FACEBOOK-PRIORITY: 1
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="b1_ca2180dd82544c68dd6601660d9cc9a9"


--b1_ca2180dd82544c68dd6601660d9cc9a9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi xxxxxxxx,

You recently asked to reset your Facebook password. Go here to change your =
password:=C2=A0https://www.facebook.com/recover/code?u=xxxxxxx&n=
=xxxxx

Alternatively, you can enter the following password reset code:

xxxxx

Didn't request a new password? Let us know here:=C2=A0https://www.facebook=
.com/login/recover/disavow_reset_email.php?n=xxxxxxx&id=xxxxxxx

Thanks,
The Facebook Team

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
This message was sent to xxx@msn.com at your request.
Facebook, Inc., Attention: Department 415, PO Box 10005, Palo Alto, CA =
94303

Edit I hope it is harmless and I will be able to take @adnan's and @graham's answers as final.

share|improve this question
    
It would be helpful if you could include more information, maybe copy the contents of the message source in your question so we can analyze it. Remove any personally identifiable information before you do, though. Alternatively, go on Facebook and request a password change and see how the received email differs from the ones you just got. Then add that information in your question. Thanks! –  TildalWave May 15 '13 at 14:02
    
interestingly, my wife got one of these for the first time on her Android yesterday. The message also included the name and location "Howard from Houston" and asked her "do you know this person?" to which she said no and then she was forced to change her password in the Android app (did not ask for old passwd). The problem is that the user has no cue as to whether it is real or not. –  Callum Wilson May 15 '13 at 14:35
    
Thank you for posting the email source. Looking at it, I can verify that my answer is indeed correct and this is not a phishing attack at all. All the headers checkout and the links are all HTTPS and they lead to the real Facebook website. –  Adnan May 15 '13 at 14:48
    
Thanks for all the time spent on answering, now the question and my doubt shall rest in peace. –  sansknwoledge May 16 '13 at 5:39

1 Answer 1

up vote 5 down vote accepted

Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very likely.

So, there are two explanations for this, one is the official Facebook explanation:

it's likely that someone accidentally entered your email address or username when attempting to log in to their account. This often happens if you have a popular username or email address. As long as you don't click the link contained in the email, no action will be taken and your account will remain secure.

The other possibility is that someone is trying to hijack your Facebook account. Again, no need to worry, just follow these steps:

  1. Ignore the email. Now that I see that the links are authentic, I think it's a good idea to click on the link next to "Didn't request a new password? Let us know here" , this way you'll be able to report this to Facebook.

  2. Follow Facebook's security guidelines.

  3. Make sure you have a strong password for your email account (it's also not a bad idea to change it)

Update: Now that you posted the message source, I can be even more confident that it is indeed an authentic email from Facebook and my answer is correct. The headers seem to be legitimate and the links all lead to the real Facebook website.

share|improve this answer
    
Deleted my answer and +1d you. –  Sébastien Renauld May 15 '13 at 14:05

protected by Community Feb 1 at 20:26

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.