Why does the contact password reset link return expired session message even though it is within expiration period?

Environment:

Contact Password, Configuration Settings
Oracle B2C Service, All versions

Resolution:

The validity duration of a contact's password reset link is set thru SEC_EU_EMAIL_LINK_EXPIRE configuration setting. If the URL has been clicked within that duration and returns "The link you used to access this page has expired." message would suggest that URL has been modified. The system does not send a different message (i.e. URL invalid) if the URL was changed but is not expired. 

It is possible that the contact's organization have a configuration in its email client that rewrites URL link. In this case, we suggest to use a different email address temporarily to change the password successfully.