Might be worth to add that thes kind of messages often come from real friends, so check with them and in case they haven't sent anything, ask them to change their password.