I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your password immediately."

Ignoring the humor of being told to change my password immediately when my access to the password reset has been locked for 24 hours, is there actually value to changing your password when someone fails to login to your account? If the attacker, by fact that the login failed, doesn't have your password, it's not clear to me why the password should be changed. Maybe the assumption is that if you're using a poor password, this would encourage you to change to a better password?

  • 2
    How sure are you this is not a phishing attempt? Is there a link in the mail where you supposedly must change the password?
    – Jeff
    Commented Jun 28, 2018 at 17:24
  • 1
    I considered it being a phishing attempt, except that the link goes to Citi's actual website, which is https. I think that means it's legit? Commented Jun 28, 2018 at 19:16
  • haveibeenpwned.com suggests Ticketfly was recently breached (and apparently never notified users at all). I use long, random, unique passwords everywhere though, so sounds like this is just bad advice from Citi. Thanks yall! Commented Jun 28, 2018 at 19:20
  • A variation on this is when you get a password reset email which you didn't request. Again, they often advise you to change your password, which doesn't make any sense to me. If you're using a secure password already, why change it just because some random goon tried and failed to get into your account? What they really should do is advise you to use two-factor authentication if you're not already.
    – Kal
    Commented Feb 12 at 23:29

2 Answers 2


If the password was randomly chosen, then there's no reason to do so.

There might be a reason if someone is trying targeted password at you. ie: if they know you like horses, you are born on 1990, and you're from Alabama, then they might be trying all combinations of these words. Changing your password then could be useful, but not because someone is trying to break into your account, but because the password wasn't originally random.

Another reason could be that someone else found your password on a paper and it contains "0" and "O" and "o", so they are trying all combinations of these.

So for random passwords that were not printed, it's useless.

Knowing that users actually come up themselves with passwords instead of generating random ones, changing your password in such case would probably be less secure, because you'll quickly run out of ideas for your password, and chances are you'll come up with a simpler and simpler one every time you change it.


If your password is strong enough and random (can withstand dictionary type of attack) you don't need to worry about it.

But the fact is attacker knows your user name (that's why the login attempts were tagged under you) and trying to guess the password.

In this case, consider changing the account username and most of the banks recommend to choose a username with combination of alphabet/numbers.

  • 1
    My bank for example doesn't let me change my user name. It's a given contract number by them.
    – Marcel
    Commented Jun 29, 2018 at 6:25
  • 1
    Usernames aren't intended to be strictly secret, only unique on a given site. Most websites even let you log in with your email address which for its intended use needs to be fairly public.
    – Ben
    Commented Jul 12, 2018 at 19:01
  • @Ben: Some banks DO treat your username as a confidential part of your login credentials, and it can be pretty important too if that bank doesn't give you the freedom to use long passwords. Think a bank wouldn't be stupid enough to enforce SHORT passwords? I promise you, some banks really are that stupid! It may not be possible to change the username yourself, but if my account was getting an endless stream of attacks, I'd be talking to my bank and asking them to change it.
    – Kal
    Commented Feb 12 at 23:50
  • 1
    PS. An interesting read from Troy Hunt about banks limiting password length and why it may not actually matter. troyhunt.com/…
    – Kal
    Commented Feb 13 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .