What to Do After an Unfamiliar Sign-In Alert

Do not use links or phone numbers in the alert. Open the account provider’s official app or type its address yourself, then check recent sign-in activity. If the event is not yours, change the password, sign out unknown devices, review recovery details, enable two-factor authentication, and use the provider’s recovery process if you cannot sign in.

Check the alert without using its link

An unfamiliar sign-in alert should be verified from the account provider’s official app or website, not from the notification itself. Alerts can describe an unusual attempt rather than a completed sign-in, so treat the message as a warning until account activity confirms what happened.

1. Open the provider’s app from your device, or type the provider’s known web address yourself.
2. Go to the account’s Security, Sign-in activity, Recent activity, or Devices area. The exact name varies by provider.
3. Compare the alert’s time, device, browser or app, location, and sign-in result with what you recognize.

Google’s account guidance directs users to review unfamiliar activity and change the password from the account’s security settings. Microsoft likewise describes unusual sign-in notices as alerts about sign-in attempts and may send them to alternate contact methods.

Expected result: You can identify whether the event matches a device or session you control. If the provider shows no matching event, continue securing the account but do not assume the alert itself is authentic.

Decide whether the sign-in was yours

The account activity record, not the message wording alone, determines the safest next action. Mark the event as unfamiliar when you do not recognize the device, time, app, location, or result and did not authorize someone else to use the account.

• Recognized activity: Check whether the provider lets you confirm it was you, then review the remaining security settings.
• Unknown attempt: Continue with a password change and session review even if the attempt was blocked.
• Unknown successful sign-in: Treat the account as potentially compromised and complete every security step below.

Do not contact an address or number supplied by the alert. A genuine notification can still be imitated by a phishing message, and a familiar-looking sender name does not prove the message is safe.

Change the password from official account settings

Change the account password directly from its Security or Password settings when the sign-in is unfamiliar. Google specifically provides a Change password action from an unfamiliar-activity notification or from the Google Account security area.

1. Open the provider’s official account settings.
2. Select Password or Change password.
3. Create a new, unique password that you have not used on another account.
4. Save it, then update the password in your trusted password manager if you use one.

If the new password is rejected, the page repeatedly fails, or you are unexpectedly signed out, do not keep retrying through the alert. Use the provider’s official recovery process instead.

Expected result: The provider confirms the password change and allows you to continue managing security settings. A password change alone does not prove that every existing session has ended, so continue to the next step.

End unknown sessions and review recovery details

Sign out devices and sessions you do not recognize, then check the recovery information that could be used to regain access. Look for Devices, Where you’re signed in, Sessions, Recent activity, Recovery email, Recovery phone, and connected apps.

1. Remove or sign out every unknown device and browser session.
2. Confirm that the recovery email address and phone number belong to you.
3. Delete unfamiliar authenticator devices, passkeys, app passwords, or connected applications.
4. Review recent account changes, sent messages, file activity, purchases, or forwarding rules when the account offers those records.

If a recovery address, phone number, or sign-in method was changed without your approval, treat that as evidence of account takeover. Do not delete records you may need for the provider’s investigation; save the time, device information, and screenshots privately.

Expected result: Only your known devices, recovery methods, and approved applications remain. If an unknown session returns after removal, change the password again from the official site and contact the provider through its official support channel.

Turn on two-factor authentication or a passkey

Enable two-factor authentication after the password is secure so a password alone is not the only sign-in barrier. Choose an authenticator app, security key, passkey, or another method the provider supports and that you can reliably access.

1. Open Security settings and select Two-step verification, Two-factor authentication, Passkeys, or the equivalent control.
2. Add the new method while signed in through the official account page.
3. Save recovery codes in a private, offline location and confirm that a backup method works.
4. Remove old or unfamiliar verification methods.

Do not share a verification code with anyone who contacts you. A support representative should not need the one-time code from your authenticator or text message.

If a passkey does not work, use a verified backup sign-in method rather than repeatedly approving unexpected prompts. For Google-specific passkey problems, use the provider’s current passkey troubleshooting guidance and check that the device and screen lock meet its requirements.

Recover the account if you can no longer sign in

Use the provider’s official account-recovery page when the password fails, recovery details changed, or an attacker signed you out. Begin from the provider’s main website or app rather than a link in the alert.

1. Choose the account-recovery or account-help option.
2. Provide the requested identity and ownership information accurately.
3. Use a previously trusted device or recovery method when the provider offers that choice.
4. After access returns, repeat the password, session, recovery-detail, and two-factor checks.

Do not pay a person who promises to bypass recovery, and do not give anyone your password or verification codes. If recovery fails, follow the provider’s official escalation options. For Apple Accounts, Apple’s recovery process may use a trusted device, recovery contact, or account-recovery waiting period depending on what remains available.

Stop condition: Stop normal troubleshooting if the provider cannot verify ownership or if you see ongoing unauthorized changes. Preserve the alert and activity details, secure related accounts, and use official support only.

Browse more Email & Social Accounts guides for help with this topic.