Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users are also consistently bombarded with phishing emails. Our rule of thumb we tell our users is "Don't click on links in emails you didn't expect".
However now that we are rolling out password expiration, we are planning to send emails to users who's passwords will expire soon urging them to change their password.
- Are well branded and look professional
- Personally identify the user with their username and an internal (although not completely private) ID number
- Clearly explain what is going on, and what action to take
- Contain proper headers identifying the sending email server is from our organization for advanced users (e.g. we aren't sending these from off-site)
However to make life significantly easier on users, we have a couple links in the emails:
- A link to our documentation for password expiration on our website
- A link to the actual password reset application
- A link to the password recovery application (for lost passwords)
There is also a mini-guide on how to identify trustworthy sites by checking the URL and SSL certificate, and when in doubt to type out the address to our homepage itself, then follow the links.
My question is:
Is there any amount of legitimacy we can add to the password expiration email so users can trust this email (which they probably weren't expecting) and click on the links, or should we ditch the links all together and just tell users to do the process themselves instead of clicking on a convenient button in the email?