Check the alert in the right place
Fictional example: Elena reads “New sign-in from an unknown device”. She set up a new tablet yesterday. Instead of selecting “Secure account” in the email, she opens the service herself and finds its security overview. She compares the time, device and event type with her tablet setup.
That comparison matters because it considers her own actions as a possible explanation. However, a roughly matching time is not enough if an unfamiliar recovery address or another unexplained change appears alongside it.
Distinguish different events
A failed sign-in attempt differs from a successful login. A change to recovery contact details is a separate event again. Read the exact event description rather than judging only the location shown.
Location information can be approximate, for example because of the internet connection used. Also compare the device, timing and your actual activity. Labels vary between services; consult the provider’s current help if you cannot interpret a record. An unfamiliar location alone does not prove that somebody gained access.
Three outcomes need different responses
If the event is clearly your own action and there are no other unexplained signs, classify it accordingly inside the official account. Do not mark something as yours merely to make a warning disappear.
If a successful login or account change is unfamiliar, begin the provider’s security process promptly. If no matching event appears, the email remains unresolved. Check that you opened the right account and, if necessary, consult official support. An empty event list is not a comprehensive security guarantee.
Review access and recovery together
When somebody else may have accessed the account, review signed-in devices, additional sign-in methods and recovery contacts as well as the password. For email accounts, unfamiliar forwarding rules may also matter. Google specifically includes these areas in its compromised-account guidance.
Change a disclosed reused password at other affected services too, using a trusted access route. Do not remove every recovery method indiscriminately before understanding how you will retain access yourself. For uncertainty about settings, a current provider-specific guide is more useful than a universal sequence of menu clicks.
Keep a small record for next time
After checking, note the date, affected account and outcome without recording credentials. When you set up a new device, a short note about that action can help identify genuine alerts later. Ordinary security events do not require posting screenshots publicly.
If you cannot sign in, use the genuine provider’s account-recovery process. Do not pay an unknown contact for guaranteed recovery. A general article cannot establish whether your individual account has been fully secured after an incident.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is the email sender address enough to trust it?
No. It is a clue rather than sufficient proof. Check the event inside the account you opened independently.
Must I change every password after any alert?
Not automatically. Clearly recognised activity differs from disclosed credentials or unauthorised access.
Can I upload a screenshot to a help forum?
Only after carefully checking and removing personal information. Use the official support route for sensitive account details.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Google: Verdächtige Kontoaktivität untersuchenSource review date:
- Google: Ein kompromittiertes Konto absichernSource review date:
- Microsoft: Letzte Kontoaktivitäten verstehenSource review date:
- BACS: Phishing-Nachrichten prüfenSource review date:
