Today I have received 3 emails to my three different addresses, one with Google, one with MSN, and one with my company. All emails were sent from password+kjdmiikvhppi at facebookmail.com email address. Content are same, as if I had requested a password change. I have never requested for such a thing, and more strangely, I haven't even logged onto Facebook today. I am confused about what should be done next.

Source of one of such messages with PII removed:

Delivered-To: xxxxxxxxxx@xxxx.com
Received: by with SMTP id ni1csp8990lbb;
        Wed, 15 May 2013 04:01:05 -0700 (PDT)
X-Received: by with SMTP id h4mr32118109qej.29.1368615664824;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
Received: from mx-out.facebook.com (outmail010.ash2.facebook.com. [])
        by mx.google.com with ESMTP id k3si579007qch.125.2013.
        for <xxxx@xxxxx.com>;
        Wed, 15 May 2013 04:01:04 -0700 (PDT)
Received-SPF: pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates as permitted sender) client-ip=;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of password+kjdmiikvhppi@facebookmail.com designates as permitted sender) smtp.mail=password+kjdmiikvhppi@facebookmail.com;
       dkim=pass header.i=@facebookmail.com;
       dmarc=pass (p=REJECT dis=none) d=facebookmail.com
Return-Path: <password+kjdmiikvhppi@facebookmail.com>
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2011-q2; t=1368615663;
Received: from [] ([])
    by smout014.ash4.facebook.com (envelope-from <password+kjdmiikvhppi@facebookmail.com>)
    (ecelerity r(/root/Platform:develop)) with ECSTREAM
    id 6A/27-01069-FEA63915; Wed, 15 May 2013 04:01:03 -0700
X-Facebook: from zuckmail ([MTI3LjAuMC4x]) 
    by www.facebook.com with HTTP (ZuckMail);
Date: Wed, 15 May 2013 04:01:03 -0700
To: xxxxxx@xxxxx.com
From: "Facebook" <password+kjdmiikvhppi@facebookmail.com>
Reply-to: Facebook <password+kjdmiikvhppi@facebookmail.com>
Subject: You requested a new Facebook password
Message-ID: <ca2180dd82544c68dd6601660d9cc9a9@www.facebook.com>
X-Priority: 3
X-Mailer: ZuckMail [version 1.00]
Errors-To: password+kjdmiikvhppi@facebookmail.com
X-Facebook-Notify: password_reset; mailid=
X-Auto-Response-Suppress: All
MIME-Version: 1.0
Content-Type: multipart/alternative;

Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi xxxxxxxx,

You recently asked to reset your Facebook password. Go here to change your =

Alternatively, you can enter the following password reset code:


Didn't request a new password? Let us know here:=C2=A0https://www.facebook=

The Facebook Team

This message was sent to xxx@msn.com at your request.
Facebook, Inc., Attention: Department 415, PO Box 10005, Palo Alto, CA =

Edit I hope it is harmless and I will be able to take @adnan's and @graham's answers as final.

  • It would be helpful if you could include more information, maybe copy the contents of the message source in your question so we can analyze it. Remove any personally identifiable information before you do, though. Alternatively, go on Facebook and request a password change and see how the received email differs from the ones you just got. Then add that information in your question. Thanks! – TildalWave May 15 '13 at 14:02
  • interestingly, my wife got one of these for the first time on her Android yesterday. The message also included the name and location "Howard from Houston" and asked her "do you know this person?" to which she said no and then she was forced to change her password in the Android app (did not ask for old passwd). The problem is that the user has no cue as to whether it is real or not. – Callum Wilson May 15 '13 at 14:35
  • Thank you for posting the email source. Looking at it, I can verify that my answer is indeed correct and this is not a phishing attack at all. All the headers checkout and the links are all HTTPS and they lead to the real Facebook website. – Adi May 15 '13 at 14:48
  • Thanks for all the time spent on answering, now the question and my doubt shall rest in peace. – sansknwoledge May 16 '13 at 5:39
  • maybe add 2-step verification to your account and sleep well – Hoang Huynh Aug 22 '14 at 18:16

Relax, no need to worry. The email address password+kjdmiikvhppi@facebookmail.com does seem to be authentic. It could be spoofed, but if it were spoofed it would be very likely moved automatically to the Junk or Spam folder. Of course, it is possible that the email is spoofed and it wasn't caught in the spam filter, but I personally think it's not very likely.

So, there are two explanations for this, one is the official Facebook explanation:

it's likely that someone accidentally entered your email address or username when attempting to log in to their account. This often happens if you have a popular username or email address. As long as you don't click the link contained in the email, no action will be taken and your account will remain secure.

The other possibility is that someone is trying to hijack your Facebook account. Again, no need to worry, just follow these steps:

  1. Ignore the email. Now that I see that the links are authentic, I think it's a good idea to click on the link next to "Didn't request a new password? Let us know here" , this way you'll be able to report this to Facebook.

  2. Follow Facebook's security guidelines.

  3. Make sure you have a strong password for your email account (it's also not a bad idea to change it)

Update: Now that you posted the message source, I can be even more confident that it is indeed an authentic email from Facebook and my answer is correct. The headers seem to be legitimate and the links all lead to the real Facebook website.


Not the answer you're looking for? Browse other questions tagged or ask your own question.