Visitor
•
9 Messages
Frequent password resets required
In 2026, Xfinity has required me to change my password 15 times!!!!!! There is absolutely no reason why this should be happening. I have two step authentication and no one else has access to my cell phone. It is with me at ALL times in my pocket. When I change it, it CANNOT be any password I have ever used in the past. I currently have a list of 20 passwords I have used for this account and am running out of ideas to have a password I can remember. THIS IS RIDICULOUS! I use two laptops, two cell phones and occasionally use our church computer to access my email. I sometimes also use different browsers so I get notices that a new device has accessed my email. NO, it's ME!!!! The fact that I am using two-step authentication should indicate that it is me. Changing my password constantly is not only annoying but unnecessary. I have called about this a couple of times, and they start out "helping" me change my password. I inform them that I know how to do it, but want to know WHY I have to do it and to please STOP making me change it to which they refer me to the fraud department that allegedly does something and assure me it will never happen again, and then it happens again. How can I stop this from happening??
XfinityFrank
Official Employee
•
2.8K Messages
5 months ago
Hi there, @victorian00. Thanks for reaching out to us here on the Community Forum. The main reason the system would force a password reset is if suspicious activity is detected. This can include the email address being used on multiple accounts, and frequent logins from different physical locations and devices. When you are forced to reset, is there anything you have noticed that is a pattern leading up to it?
9
0
victorian00
Visitor
•
9 Messages
4 months ago
07/11/26 - IT HAPPENED AGAIN! I called above and got the same [Edited: "Profanity"]!
(edited)
3
0
user_va7twr
Visitor
•
1 Message
3 months ago
I am having the same problem. Only use my phone for email and out of the blue I see failed login and have to reset my password. I too am getting very frustrated. I hear that we are all going to be setup with yahoo accounts but when will that happen???
4
0
user_woidtm
Visitor
•
2 Messages
2 days ago
I too face this problem on several of Xfinity owned accounts. Clearly this an ongoing issue that Xfinity doesn't know how to address. I have now been forced to reset my Xfinity password at least six times in approximately three months, despite having two-step verification enabled. At this point, simply forcing another password change is not an acceptable solution. Something appears to be wrong with either the risk detection, authentication workflow, or the way the two systems interact.
Xfinity has publicly stated that forced password resets can result from suspicious-activity detection, including activity involving different devices or physical locations. That's understandable as a security signal. What's not clear is why those signals repeatedly result in mandatory credential rotation even after the legitimate customer successfully verifies their identity using 2FA.
What would be helpful from Xfinity is to explain is:
What specific security signal keeps causing these forced password resets?
First, rule out actual account compromise
Before forcing another password change, I would expect Xfinity's security team to investigate whether there is actual evidence of compromise, including:
If there is evidence that my credentials have actually been compromised, respond with the the appropriate action needed to be taken.
But if there is no evidence of successful account compromise, then the bigger question is why Xfinity continues requiring password rotation instead of using 2FA or another form of step-up authentication to establish that the person accessing the account is legitimate.
Suspicious activity is not necessarily a compromised password
This is the part of Xfinity's implementation that I think needs more scrutiny.
There is an important distinction between:
1. Someone attempting to compromise my account
and
2. Someone actually possessing my password and successfully compromising my account
Those aren't the same security condition.
For example, if an attacker is running credential-stuffing attempts against my Xfinity ID, that absolutely should raise a security signal. But if the attempts are unsuccessful, why should the legitimate customer be forced to continually change a strong password?
Likewise, if I legitimately access Xfinity from a new browser, device, IP address, network, or geographic location, that might justifiably trigger additional authentication. That's exactly where 2FA or step-up authentication should come into play.
If I successfully provide the second authentication factor, that information should materially affect the risk decision.
Otherwise, what exactly is 2FA accomplishing in the overall risk model?
Is the underlying risk condition actually being cleared?
This is another question I would like addressed.
The pattern I'm experiencing makes me wonder whether something like this is happening:
Suspicious activity detected → Account risk flag generated → Mandatory password reset → Password changed → 2FA completed → Account restored → Same underlying risk signal remains or reoccurs → Mandatory password reset again
If that's what's happening, changing the password isn't fixing the problem. It's treating the symptom while leaving the underlying security condition unresolved.
That would certainly explain how someone could be forced through six password changes in roughly three months.
Questions I would like Xfinity Security to answer
What precise event or risk condition triggered each forced password reset?
Are failed login or credential-stuffing attempts against an account causing Xfinity to force a change to password?
Has Xfinity detected any successful unauthorized authentication associated with an account?
Does successfully completing two-step verification lower or clear the security risk associated with a suspicious authentication attempt?
Why does the security system require credential rotation instead of step-up authentication when 2FA is already enabled?
Is there a persistent security or fraud-risk flag associated with an account that isn't being cleared when the password is changed?
Are device fingerprinting, browser fingerprinting, IP reputation, VPN/proxy detection, geolocation, or unusual-login algorithms contributing to these resets?
Can cases like this be escalated to the team responsible for Identity and Access Management, Account Security, or Fraud/Risk instead of simply sending customers through another password-reset workflow?
Is Xfinity actively working to modernize this behavior, and if so, is there a timeline for addressing these seemingly antiquated password-reset protocols?
I don't need help resetting my password
To be clear, I know how to reset my password.
I don't need another support representative to walk me through password reset number seven.
I want Xfinity to identify why the account continues to be flagged in the first place.
Six forced password changes in approximately three months while 2FA is enabled is excessive. It is also materially different from my experience with other major services where I use multi-factor authentication.
I'm completely supportive of aggressive account security. If someone is attacking my account, I absolutely want Xfinity to detect it.
But good security isn't simply:
Something looks suspicious → Make the customer change their password again.
Modern authentication should distinguish between attack activity, credential compromise, account compromise, and legitimate customer activity that happens to look unusual. Strong authentication such as 2FA should factor into that risk decision.
Otherwise, Xfinity risks turning an account-protection mechanism into a recurring burden on the very customer it's supposed to protect.
Xfinity, please escalate this beyond routine password-reset support. Someone on the Identity, Account Security, Fraud/Risk, or authentication engineering side needs to look at why this continues to happen and explain what is actually triggering these resets.
And if other Xfinity customers with 2FA enabled are experiencing repeated forced password resets, I'd be interested to hear how frequently it's happening to you as well.
2