Recently a provider (of SIP trunking services) I subscribe to sent me a strange email. It claimed that someone in another country attempted to reset the password to my account and was unsuccessful in answering my security question.
The provider's response to this event was to reset my password.
We received a request to reset the password for the account ‘myusername’ from the IP address 18.104.22.168 but the security question entered was invalid.
As a security precaution we have set your accounts password to: roRy1391
Once you have logged in you will be prompted to change your password immediately.
(The email turned out to be real, and I was able to login and change my password successfully.)
It seems to me that the appropriate response to such an event is for the provider to do nothing. After all, what if this attacker had already gained access to my email account? Then he would have received this email, and gotten access to my account anyway.
However, there is a possibly mitigating factor. This provider always requires answering the security question whenever logging in from a new IP address. This also, in theory, would have stopped this attack if the attacker had gotten access to this password reset email.
Was this an appropriate action on the provider's part? If not, what should they have done instead, and what should I say when I yell at them?