Account email

Verify, recover, and stay safe

NexinID sends time-sensitive account messages for specific identity and organization actions. Use this guide to recognize an authentic message, complete the action safely, and recover when a message is delayed or no longer valid.

Never share a secret with support

NexinID will never ask you to reply with a password, one-time link, access token, MFA code, authenticator secret, or recovery code. Do not forward a complete account email or its action link to anyone.

Expected messages

Why NexinID may email you

Account email is transactional and tied to an action. Receiving a request-accepted message on screen does not confirm that an email address or account exists, is eligible, or received a message.

Verification

Verify an address or confirm an email change

A new local account or a requested primary-email change may require confirmation before the address can be trusted for recovery.

  • Open only the newest message you requested.
  • Review the action on the NexinID page, then explicitly confirm it.
Recovery

Reset a password or MFA access

Password and MFA recovery use a verified destination when the account is eligible. Public request screens deliberately do not disclose those checks.

  • A recovery link is time-limited and can be completed once.
  • After a reset completes, a separate security notice may arrive without an action link.
Organization access

Accept an organization invitation

An organization administrator may invite you to join. Check that you recognize the organization and expected the invitation before continuing.

  • Sign in with the address that received the invitation.
  • If another account is open, use Use a different account on the invitation page so the invitation handoff is preserved.
Authenticity checks

Check the message before you act

A familiar logo or display name is not proof. Check the actual address and destination every time, especially for recovery and invitation messages.

Inspect the sender address. Account messages use a NexinID-controlled nexinid.com address. Treat misspellings, added words, and unrelated domains as suspicious.
Inspect the destination. Production account actions open on exactly identity.nexinid.com over HTTPS. A longer hostname such as identity.nexinid.com.example.net is not NexinID.
Review before confirming. Opening an authentic link shows a confirmation page; it does not complete the action merely because an email scanner or preview opened it.
Keep the action private. Never paste the full link into chat, a ticket, or a shared document. Support can help without receiving the token.
Delivery and expiry

If the message did not arrive or the link expired

Delivery can be delayed or suppressed, and every action has a bounded lifetime. Repeated requests may be limited without revealing account details.

1

Check safely

Wait a few minutes, then check spam, junk, and mail rules. Confirm that you used the intended address without posting it publicly.

2

Request one fresh message

Return to the original NexinID sign-in, verification, or recovery surface and request a resend. A newer request can replace an older link, so use only the newest message.

3

Recover an invitation through its owner

If an invitation expired or was revoked, ask the inviting organization administrator to verify the destination and send a new invitation.

4

Escalate without secrets

Contact support with the action type, approximate request time, masked destination, and tenant or organization name when known. Never include a password, code, or complete action URL.

Unexpected activity

If you did not request the email

Do not click an unexpected recovery or invitation link. Open NexinID independently from a saved bookmark or by typing the official address.

Ignore an unrequested verification, recovery, or invitation action. A request alone does not complete a change.
If a password or MFA reset completion notice is unexpected, sign in independently, review account access, and secure the account immediately.
Report suspicious sender domains or lookalike pages through the official support route. Do not reply to the suspicious message.
Ask an organization administrator to confirm an unexpected invitation through their normal administration portal.

Still need help?

Use the official support form. Share only non-secret context: the kind of action, approximate timestamp, masked destination, and organization name when relevant.

Contact support