"Was this you?" reset traps

A message says a sign-in or password reset was requested — "if this wasn't you, click here to secure your account." The link leads to a fake page that harvests the password you type in.

What to do: if you didn't request it, ignore the link. Go to the real site directly and change your password there if you're worried. Turn on phishing-resistant 2FA.