8

I just received an email from Citi saying "We've locked your access for 24 hours due to multiple failed login attempts." and "If you didn’t attempt these logins, we recommend that you reset your password immediately."

Ignoring the humor of being told to change my password immediately when my access to the password reset has been locked for 24 hours, is there actually value to changing your password when someone fails to login to your account? If the attacker, by fact that the login failed, doesn't have your password, it's not clear to me why the password should be changed. Maybe the assumption is that if you're using a poor password, this would encourage you to change to a better password?

Improve this question
3
  • 2
    How sure are you this is not a phishing attempt? Is there a link in the mail where you supposedly must change the password?
    – Jeff
    Jun 28, 2018 at 17:24
  • 1
    I considered it being a phishing attempt, except that the link goes to Citi's actual website, which is https. I think that means it's legit?
    – Cannoliopsida
    Jun 28, 2018 at 19:16
  • haveibeenpwned.com suggests Ticketfly was recently breached (and apparently never notified users at all). I use long, random, unique passwords everywhere though, so sounds like this is just bad advice from Citi. Thanks yall!
    – Cannoliopsida
    Jun 28, 2018 at 19:20

2 Answers 2

Reset to default
6

If the password was randomly chosen, then there's no reason to do so.

There might be a reason if someone is trying targeted password at you. ie: if they know you like horses, you are born on 1990, and you're from Alabama, then they might be trying all combinations of these words. Changing your password then could be useful, but not because someone is trying to break into your account, but because the password wasn't originally random.

Another reason could be that someone else found your password on a paper and it contains "0" and "O" and "o", so they are trying all combinations of these.

So for random passwords that were not printed, it's useless.

Knowing that users actually come up themselves with passwords instead of generating random ones, changing your password in such case would probably be less secure, because you'll quickly run out of ideas for your password, and chances are you'll come up with a simpler and simpler one every time you change it.

Improve this answer
0
-2

If your password is strong enough and random (can withstand dictionary type of attack) you don't need to worry about it.

But the fact is attacker knows your user name (that's why the login attempts were tagged under you) and trying to guess the password.

In this case, consider changing the account username and most of the banks recommend to choose a username with combination of alphabet/numbers.

Improve this answer
2
  • My bank for example doesn't let me change my user name. It's a given contract number by them.
    – Marcel
    Jun 29, 2018 at 6:25
  • Usernames aren't intended to be strictly secret, only unique on a given site. Most websites even let you log in with your email address which for its intended use needs to be fairly public.
    – Ben
    Jul 12, 2018 at 19:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .