Emails. Done.

Templates

How to write an account locked email users actually understand

An account locked email is one of the most important security emails your application will send.

Unlike a welcome email or notification, the recipient is usually unable to access their account and may not know why.

The purpose of the email is simple:

  1. Explain what happened.
  2. Explain what happens next.
  3. Provide a clear action if one is required.

The best account locked emails are clear, concise and difficult to misunderstand.

They are not marketing emails.

A simple default account locked email

A useful account locked email should work even when your application does not have much context.

For example:

Subject: Account locked

Preheader: Your account has been locked for security.

Heading: Account locked

Intro: Your account has been locked for security.

Notice: For security reasons, additional verification may be required before access is restored.

Action: Unlock account

This is intentionally generic.

It does not assume why the account was locked or what the user needs to do next.

That makes it a good default for many applications.

What an account locked email should include

Most account locked emails should contain:

  • A clear subject line
  • A short explanation
  • The reason for the lock if known
  • A timestamp if useful
  • A clear next step
  • Company details in the footer

The amount of information should match the sensitivity of your application.

A hobby project, SaaS product and online banking platform do not need the same account locked email.

Scenario 1: Too many failed login attempts

This is one of the most common reasons for an account lock.

The user may simply have forgotten their password or entered it incorrectly several times.

The tone should be calm and informative.

Avoid language that suggests the account has been compromised unless you have evidence that it has.

curl -X POST 'https://api.emailsdone.dev/v1/contacts/send' \
  -H 'Authorization: Bearer ed_xxxxxxxxxxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  --data '{
    "templateId": "account-locked",
    "to": "mike@example.com",
    "data": {
      "subject": "Account locked",
      "preheader": "Your account has been locked after too many failed sign-in attempts.",
      "heading": "Account locked",
      "intro": "Your account has been locked after multiple unsuccessful sign-in attempts.",
      "notice": "If this was you, follow the steps below to restore access.",
      "actionButton": {
        "label": "Unlock account",
        "url": "https://example.com/account/unlock"
      },
      "lockDetails": {
        "lockedAt": "2026-06-23T10:15:00Z",
        "reason": "Too many failed sign-in attempts"
      }
    }
  }'

This tells the user what happened and provides a straightforward path back into their account.

Scenario 2: Identity verification required

Some applications temporarily lock accounts until the user's identity has been verified.

This commonly happens after:

  • Account recovery requests
  • Password resets
  • MFA enrolment
  • Security-sensitive account changes

In this situation, the lock is a precaution rather than a punishment.

The email should explain that additional verification is required before access can be restored.

curl -X POST 'https://api.emailsdone.dev/v1/contacts/send' \
  -H 'Authorization: Bearer ed_xxxxxxxxxxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  --data '{
    "templateId": "account-locked",
    "to": "mike@example.com",
    "data": {
      "subject": "Identity verification required",
      "preheader": "Verify your identity to restore access to your account.",
      "heading": "Identity verification required",
      "intro": "For security reasons, your account has been temporarily locked until your identity has been verified.",
      "notice": "Complete the verification process below to restore access.",
      "actionButton": {
        "label": "Verify identity",
        "url": "https://example.com/verify"
      },
      "lockDetails": {
        "lockedAt": "2026-06-23T10:15:00Z",
        "reason": "Identity verification required"
      }
    }
  }'

The important distinction here is that the user is not simply unlocking their account. They must complete an additional verification step first.

Scenario 3: Manual review or administrative lock

Sometimes an account is restricted by a support agent, compliance process or automated moderation system.

In these situations, there may be nothing the user can do immediately.

Avoid including an action button if there is no meaningful action available.

The email should explain the situation and set expectations.

curl -X POST 'https://api.emailsdone.dev/v1/contacts/send' \
  -H 'Authorization: Bearer ed_xxxxxxxxxxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  --data '{
    "templateId": "account-locked",
    "to": "mike@example.com",
    "data": {
      "subject": "Account access temporarily restricted",
      "preheader": "Your account access has been temporarily restricted pending review.",
      "heading": "Account access restricted",
      "intro": "Your account access has been temporarily restricted while our team reviews recent activity.",
      "notice": "You do not need to create a new account. We will contact you when the review is complete.",
      "lockDetails": {
        "lockedAt": "2026-06-23T10:15:00Z",
        "reason": "Manual security review"
      }
    }
  }'

If there is no useful action for the user to take, do not add a button simply to fill space.

Scenario 4: Billing-related access restriction

Not every account lock is security related.

Many SaaS applications restrict access when a subscription expires or a payment fails.

The wording should reflect the actual problem.

A failed payment should not sound like a security incident.

curl -X POST 'https://api.emailsdone.dev/v1/contacts/send' \
  -H 'Authorization: Bearer ed_xxxxxxxxxxxxxxxxxxxx' \
  -H 'Content-Type: application/json' \
  --data '{
    "templateId": "account-locked",
    "to": "mike@example.com",
    "data": {
      "subject": "Account access paused",
      "preheader": "Your account access has been paused until your billing details are updated.",
      "heading": "Account access paused",
      "intro": "Your account access has been paused because we were unable to process your latest payment.",
      "notice": "Update your billing details to restore access.",
      "actionButton": {
        "label": "Update billing details",
        "url": "https://example.com/billing"
      },
      "lockDetails": {
        "lockedAt": "2026-06-23T10:15:00Z",
        "reason": "Payment failed"
      }
    }
  }'

The user's next step here is updating their billing information, not resetting their password or verifying their identity.

A better default

A good default account locked email should remain useful even when no additional data is supplied.

For example:

{
  "actionButton.label": "Unlock account",
  "heading": "Account locked",
  "intro": "Your account has been locked for security.",
  "notice": "For security reasons, additional verification may be required before access is restored.",
  "preheader": "Your account has been locked for security.",
  "subject": "Account locked"
}

This wording is intentionally neutral.

It works for a wide range of applications without making assumptions about why the account was locked.

Final checklist

Before sending an account locked email, ask:

  • Does the subject clearly explain what happened?
  • Does the email explain why the user received it?
  • Is the next step obvious?
  • Does the button label match the action being performed?
  • Are any lock details accurate and useful?
  • Have you avoided unnecessary alarm or technical jargon?
  • Does the footer clearly identify your company?

The best account locked emails are usually the simplest.

They explain the problem, tell the user what to do next and help them regain access as quickly as possible.