Login and security alert emails
From time to time, KolleK may email you without you asking for anything. These alerts exist to make sure that when something happens around your user, you hear about it from KolleK before you hear about it any other way. This page lists each alert, what it means, and what to do if one surprises you.
Failed sign in attempt
When it arrives: someone entered your email with a wrong password on the sign in page.
If it was you, mistyping your own password, ignore it.
If it was not you, someone is trying your address. One failed attempt is usually just noise, but repeated alerts mean your email is being targeted. Make sure your password is unique to KolleK, and turn on two factor authentication so a guessed password is not enough.
New sign in
When it arrives: a successful sign in happened, and the email names the device it came from.
If it was you, on a new browser, phone, or computer, ignore it.
If it was not you, someone has your password. Change your password immediately, and review your account for anything unexpected.
IP address change
When it arrives: you signed in from a different network address than last time.
This is normal when you travel, switch networks, or your provider rotates addresses. It only deserves attention if it arrives alongside a sign in you do not recognize.
API key created, API key deleted
When it arrives: an API key was created or revoked on your user.
If it was you, managing your keys, ignore it.
If it was not you, treat it seriously. An unexpected key means someone had enough access to create one. Revoke the key, change your password, and check your remaining keys and their last used times.
Sign in tokens created when you log in through the API do not trigger the key created email. Only keys you create by hand do, so the alert stays meaningful.
Emails you asked for
Two other emails arrive only because someone requested them, so they are not alerts in themselves: the magic link email, and the password reset email. If you receive one you did not request, someone entered your address in that form. Neither can be used without access to your inbox, but repeated unrequested emails are another sign your address is being poked at.
If something genuinely looks wrong
- Change your password.
- Turn on two factor authentication if it is off.
- Review your API keys and revoke anything you do not recognize.
- Check your personal activity log for actions you did not take.
Where to next
- See everything KolleK has ever sent you, with delivery status: Your personal activity log and sent emails.
- The full catalogue of every email KolleK can send: Emails KolleK sends.