How to prompt existing customers to change their passwords

Question

I'm looking for some UX examples of how other companies have handled this situation:

Scenario:
Devs are using an old password encrypting method (sha1) I believe and need to change it to a more secure encryption.

What they did:
When users logged in they just encrypted their password with the new encryption and the users didn't know a thing.

The only problem is we have a number of users who aren't frequent users who will only login periodically.

Devs want to clear all the passwords and require users to reset their passwords.

Problem:
We don't want to alert them to the fact that there are security issues as we hold a lot of important data in their accounts of users customers.

When that happens users would attempt to login and just get hit with a message saying their login details are incorrect.

The initial approach was: users will eventually just click on forgotten password after being told 'invalid credentials'.

However, this just feels wrong and we've tried to think of various flows but due to development constraints we have to stick with them having to click on the "forgotten password" link. (not the best solution but need to make the most out of this)

My question is:
What message would make sense in asking them to reset their password that doesn't alert to security issues?

Additionally, are there any existing companies that have handled randomly asking users to reset their passwords?

Answer 1

Ignoring the issue of lying to your customers, whether blatantly or through omission, you could simply say something like

Due to recent changes, on our server we require all passwords to be updated. Sorry for any inconvenience.

My personal choice, however, would be to be as honest as you can (though, without losing user confidence)

We have recently improved security on all accounts as part of our commitment to you. Unfortunately, this means you need to update your password. Please sign in and complete this step at your earliest convenience.

Answer 2

Nobody cares about the "type" of security you're using. Users only care how it impacts them.
In your case, the impact is as simple as resetting a password. And you're not lying by saying you're making it better (assuming it was reasonably secure before).

So, I agree that some messaging along the lines of:

We've recently updated our security systems and ask that you update your password as soon as possible by clicking here.

Would be the best solution on your site and in emails.

Just don't make people find the "forgot password" link since that isn't the process playing out in their heads. You can use the same flow, just call it something else.

As for messaging examples, look at how different software tools are marketing two-factor authentication. Especially pay attention to places that REQUIRE two-factor systems. They have a lot of messaging about making things "more secure" and how that's a benefit to you the user.

Zapier did a marketing email a few years ago attached to "security awareness" month. Unfortunately, I can't find it now, but it showed a bunch of tools that connect to Zapier with little mini tutorials about how to set secure passwords, add two-factor auth (on those sites) and a bit of the value. It was all done with a bit of humor but the call to action was enable two-factor auth for your Zapier account.
It was nice because it was all about "general internet security" not all about them.

Answer 3

We have recently improved security on all accounts as part of our commitment to you. Unfortunately, this means you need to update your password. Please sign in and complete this step at your earliest convenience.