Spam? Phishing? Genuine notification from musescore.org?

Hi,

I would send an email to support@musescore.com . Thomas would likely clarify.

Sounds to me as though someone has been trying to hack your MuseScore.com account

I suspect that ChurchOrganist is correct. Maybe one of the perils of being near the beginning of the alphabet (as a naive hacker works his way through a list)?

If you, within the past one minute, did, in fact, ask to reset your password at some web-site or another, then such an e-mail might, conceivably, be legitimate.

However, a scammer could just-as-easily send you an e-mail which, although it displayed a perfectly-legitimate-looking email address in the text of the embedded hyperlink, actually had a destination that was altogether different.

Bottom line:   if you did not expect it, then it is not legit.

Hi Aldo and everyone,

Thank you for raising the question and sharing your concerns.

This is a totally legit email sent by the MuseScore server. It is sent when someone requests a password reset link via https://musescore.com/user/password or our mobile domain m.musescore.com, by submitting the email address or username.

It may happen that people mistakenly enter another email address (typo) or username (typo as well). As a result, you may receive such an email even when you didn't request one yourself. In that case, simply discard the email.

Improvements

It's clear from reading all your reactions, that this is causing quite some confusion and even made some believe this is a fishing attack.

In order to reduce these fears, I have logged a todo for myself to:
* Append a small text to the email: "If you didn't make this request, ignore this email." (done already)
* Append FAQ in the footer of the email: "How do I know an email is from MuseScore?" (todo)
* Protect the password reset form with a captcha
* Protect the password reset form with an anti-flood mechanism
* Adding a user setting to require personal information to reset your password
* Add links to the email to help and security questions
* ... learn from other services to further improve.

If you have questions or remarks, please let me know.

My previous comment was specifically addressed at the issue of deliberate scammers who forge emails that exactly replicate the legitimate emails sent out by forum servers such as this one ... except for the location that the URL actually leads to.   (And they can, with JavaScript, make it very difficult to visually detect any discrepancy.)   They are up to no good.   They are purposely trying to deceive, and to thereby do harm.   And they are treading on the goodwill of the legitimate sites, creating much vexation for the site owners.

Thus:   if you know to expect it, based on your very recent actions on the forum in question, then it is likely to be legit.   But, if it “just shows up in your inbox one day,” it probably isn’t.

In short, it pays to be skeptical.

The same thing is true, say, of “FedEx® Package Notifications.”   Are you really expecting a package from someone?   Does this e-mail contain details that you know to be true for this package?   And, so on.