Speculative fiction.
The first email arrived at 9:12 on a Thursday morning.
Your password was changed successfully at 9:27 a.m.
If you did not make this change, secure your account immediately.
Leah read it twice. The time was wrong. More importantly, the password still worked.
She checked the sender, the headers, and the links without clicking any of them. Everything looked real. Then she opened the account in a new browser window and signed in. No problem.
At 9:26, feeling slightly foolish, she decided the safest thing was to change her password before somebody else could.
At 9:27, she did.
The confirmation email had already been sitting in her inbox for fifteen minutes.
A small test
Leah worked in payroll, where unexplained timing deserved a spreadsheet. She made a fresh account on a free recipe site, gave it a password she would never use anywhere important, and waited.
At 9:41, an email appeared.
Two-factor authentication was enabled at 9:56 a.m.
She had not planned to enable it. She watched the clock instead.
At 9:54, curiosity became unbearable. If she did nothing, would the email be wrong? At 9:55 she opened the settings. At 9:56 she clicked Enable.
The site displayed a QR code. Her inbox remained smugly unchanged.
Leah added two columns to the spreadsheet: warning received and thing I then did because of warning. The rows were identical so far, which was not comforting.
The afternoon forecast
By lunch, the messages were arriving from every service she used.
At 11:48, her bank warned that she would remove an old phone at 12:03. Leah had forgotten the phone was still authorized. She removed it at 12:03.
At 12:20, the library said she would update her email address at 12:35. She had no intention of doing that, but while checking the account she noticed it still used an address from college. At 12:35, she fixed it.
At 1:07, a streaming service thanked her for canceling at 1:22. She spent fourteen minutes insisting to an empty room that she liked the service. Then she looked at the price, remembered she had not watched it since February, and canceled.
The messages were useless as warnings. They were excellent suggestions.
Leah tried ignoring one. An online shop announced that she would delete a saved credit card at 2:10. She closed the email and worked until 2:09, when the thought of a card sitting unnecessarily in an account became impossible to tolerate. She deleted it with six seconds left.
That earned a new row in the spreadsheet: held out for fourteen minutes and fifty-four seconds.
The important account
At 3:32, the subject line changed.
Future security notifications were disabled at 3:47 p.m.
Leah laughed. This one, at least, would be easy to defeat. She wanted the messages. They were impossible and invasive, but they were also the most interesting thing that had ever happened to her inbox.
At 3:35 another email arrived.
Future security notifications were enabled at 3:50 p.m.
Then one scheduled their removal for 4:02. Another restored them at 4:17. A fifth said they would be paused for thirty days at 4:32.
Her phone began chiming every few seconds. Each warning provoked a decision, and each decision appeared to provoke another warning. The inbox filled with a complete administrative forecast of Leah arguing with her own settings.
At 3:46, she opened the notification page. The checkbox beside Future security alerts was still on.
She kept her hand away from the mouse.
3:46:40.
3:46:50.
3:46:58.
The second email was still open beside the settings, predicting that at 3:50 she would turn the alerts back on.
Leah clicked the checkbox off.
The phone stopped chiming. For three quiet minutes, nothing happened.
At 3:50, she turned the alerts back on, just to see whether the email had been right.