Wise Group checks new passwords against a list of easily guessed words before they’re accepted. Here’s how this works, and what to do if yours is blocked.
How password checking works
When you choose a new password, Microsoft checks it against a list of words that threat actors commonly guess. The list combines Microsoft’s own list with terms specific to Wise Group and New Zealand, such as our entity and office names, local places and sports teams.
If your new password contains one of these words, it is blocked and you choose a different one. This protects your account, and the people we support, from password-guessing attacks.
What this means for you
Nothing changes for your current password. You will not be signed out, forced to reset it, or contacted, even if your current password contains a word on the list.
The check only runs when a new password is set. That happens when you:
- change your own password
- reset a forgotten password
- are given a new password by IT or the helpdesk
Your current password stays valid until the next time you change it.
What you will see if your password is blocked
You stay on the change-password screen and see an error message. It will be one of these, or close to it:
“Unfortunately, your password contains a word, phrase, or pattern that makes your password easily guessable. Please try again with a different password.”
“Unfortunately, you can’t use that password because it contains words or characters that have been blocked by your administrator. Please try again with a different password.”
“Choose a password that’s harder for people to guess.”
The message does not say which word was the problem, and your account is not locked. Your old password keeps working until a new one is accepted.
What to do if your password is blocked
- Choose a different password built from different, unrelated words, rather than tweaking the one that was rejected. Swapping letters for look-alike symbols (a to @, o to 0, s to $), changing capitals, or adding a digit or symbol at the end is treated as the same word.
- Check it meets the rules: at least 8 characters, using at least three of uppercase letters, lowercase letters, numbers and special characters. See the tips below for building a strong one.
- Try again. On your work computer, press Ctrl + Alt + Delete and choose Change a password, or go to myaccount.microsoft.com and select Change Password.
- Still blocked after two or three tries? Contact the helpdesk (see below), starting from different words rather than adjusting your last attempt.
Stay calm if you’re blocked. It’s the new password that was rejected, not you, and nothing is wrong with your account.
Choosing a password that works
The easiest password that passes is a long passphrase of unrelated, uncommon words, with a number and a symbol added.
Do
- Aim for 14 characters or more. Longer is stronger, and 12 is only the minimum.
- Join three or four words that have nothing to do with each other or with you.
- Add a number and a symbol to meet the complexity rule.
- Use a password you have never used anywhere else.
Avoid
- Wise Group, our entity names, office names, suburbs and streets
- New Zealand cities and regions, and sports teams
- Months, days, seasons and years, such as a season followed by the year
- Keyboard patterns such as qwerty, and words such as welcome, password or letmein
- Common first names, pet names, explicit words, and anything about your hobbies or family
We do not publish the full list, because that would help attackers. If your passphrase is blocked, replace its most ordinary-looking word with a less common one.
A password is only one layer of protection. Keep multifactor authentication set up, and only approve sign-in prompts that you started yourself.
Still stuck?
Contact the helpdesk: phone 07 857 1226 or email Helpdesk@wisegroup.co.nz.
To help us fix it quickly, tell us:
- your name and the account you are changing
- whether you were changing a password or resetting a forgotten one
- roughly when it happened, and the exact message you saw (a screenshot is ideal)
Never tell anyone your password, including the helpdesk, and do not include the passwords you tried in any message.
FAQ
Do I have to change my password now?
No. Your current password keeps working. The check only applies when you set a new one.
Why was a strong-looking password blocked?
It probably contains, or is very close to, a word on the list. Look-alike symbols, capitals and a changed or extra letter do not make a blocked word different.
Can you tell me which word was blocked?
No. The message does not say, and we do not publish the list. Start again from different words.
Can I just add more characters to get it through?
Sometimes a long password containing a blocked word is accepted, but it is still a weak password. Choose different words instead.
Does this affect my personal accounts?
No. It only applies to your Wise Group work account.
Does it change how multifactor authentication works?
No. Keep your sign-in methods set up as they are.
Comments
Article is closed for comments.