If an alert says someone signed in to your account and you are thinking "someone logged into my account," do not use the alert's link. Open the official app or type the service address yourself, confirm whether an unknown session actually exists, then revoke access and secure the account from a trusted device.

Key Takeaways

A login location is a clue, not proof; travel, nearby routing, VPN use, and mobile-carrier exits can change it.

An unknown active session, changed recovery information, or activity you could not have made is stronger evidence.

Secure primary email before accounts that depend on it for password resets.

Review sessions, recovery methods, forwarding rules, third-party access, and account activity—not only the password.

The online security guide explains the wider account-security baseline; this checklist starts at the moment a successful-login alert appears.

How do you verify an unrecognized login alert?

Do not click the message. A fake alert can be phishing even when the service name and logo look convincing.
Open the service independently. Use a known official app, saved bookmark, or manually typed address.
Find security activity or active sessions. Compare the device type, browser, time, and recent actions—not location alone.
Check whether the event was yours. Consider a new device, a reset device, a shared computer, background app activity, travel, or a nearby location estimate.
Treat uncertainty conservatively. If the service offers “not me,” “secure account,” or session removal through its official interface, use it.

Before removing a confirmed foreign session, note the service's own timestamp, device label, and security-event identifier if doing so is safe. Preserve only what helps recovery; avoid sharing full screenshots that expose email addresses, recovery details, backup codes, or financial information. The account's official activity log is stronger evidence than a copied alert banner.

Google explains that one device may appear as multiple sessions, background syncing may make a timestamp look newer, and a location may be nearby rather than exact. It still recommends signing out when you are not sure a session belongs to you.［1］

Which signs make account compromise more likely?

Evidence	What it means	Confidence
A city or country you do not recognize	Network routing or a real remote login are both possible	Low by itself
An unfamiliar device or browser with an active session	Another device may currently hold access	Medium to high
Password, recovery email, phone, MFA, or profile changed	Someone may be trying to keep control	High
Messages, purchases, files, or posts you did not create	The account was used, not merely probed	High
You are locked out after a security change	Control may already have shifted	High

The FTC lists unknown-device or unknown-location alerts, unrequested password changes, lockout, and messages sent to contacts as common compromise signs.［2］ A location mismatch becomes more meaningful when it appears with one of those independent changes.

If someone logged into my account, which one do I secure first?

Use impact and recovery power to set the order:

Primary email. It can receive password resets for many other accounts.
Financial and payment accounts. Contact the provider immediately if transactions, cards, payees, or withdrawals changed.
Cloud, platform, and password-manager accounts. These may expose files, synced devices, or stored credentials.
Social and messaging accounts. Attackers can impersonate you and target contacts.
Ordinary shopping, forum, or entertainment accounts. Still secure them, especially if the password was reused.

If your email is the affected account, use a separate trusted communication channel for banking and work recovery. The FTC emphasizes email because access to the inbox can let an attacker request and collect password-reset links for other services.

Do not let the apparent value of the alerted account set the whole response. A shopping login may reveal a reused password, a cloud account may expose synced files, and a social account may give an attacker a credible way to approach contacts. Recovery power, stored data, and impersonation reach are better priority signals than the account's subscription price.

How do you revoke account sessions and restore control?

On the service's official security page:

Sign out the unknown session. If ownership is unclear, use “sign out all sessions” or the closest available option.
Change the password to a new unique one. Change every other account where the old password was reused.
Turn on MFA or replace an exposed factor. Prefer a passkey, security key, or authenticator option when supported.
Verify the recovery email, phone number, backup codes, trusted devices, and security questions.
Remove login methods, app passwords, passkeys, or devices you did not add.
Save the service's recovery case number or confirmation.

Google's device page allows users to inspect sessions and sign out devices they no longer own or recognize. The FTC likewise recommends changing the password, signing out all devices, enabling 2FA, and verifying recovery details after recovery.

Changing the password may not automatically invalidate every existing session. Use the service's explicit session controls as well; session hijacking explains why a valid token can remain separate from the password.

What hidden account changes should you inspect?

Once access is stable, look for persistence and misuse:

Email forwarding, filters, delegates, automatic replies, and connected mail clients.
Third-party apps, OAuth grants, browser extensions, app passwords, and API tokens.
New payment methods, payees, delivery addresses, orders, subscriptions, or withdrawals.
Sent, deleted, archived, or recently accessed messages and files.
Social posts, direct messages, new contacts, advertising accounts, and administrator roles.
Recovery attempts and security notifications that may have been deleted.

The FTC specifically calls out unknown forwarding rules, sent or deleted mail, social posts, and messages sent from the account. Removing a suspicious session without checking those changes can leave the attacker's access path or damage in place.

What should you do for email, financial, and social accounts?

Email accounts

Secure recovery settings, remove forwarding rules, review sent and deleted folders, and then reset important accounts that rely on that inbox. If the provider offers a recent-security-events log, preserve it.

Financial accounts

Use the official app or the number printed on the card or statement. Report unauthorized activity, freeze or replace affected payment methods when advised, and verify payees, transfer destinations, contact details, and notification settings.

Social and messaging accounts

Remove unknown sessions and third-party apps, delete fraudulent posts only after preserving useful evidence, and warn contacts through another channel. FTC guidance recommends telling contacts not to trust links or urgent money requests sent during the compromise.

Could the device itself be compromised?

If the unknown login followed a phishing download, remote-control session, suspicious browser extension, or malware warning, account recovery alone may not be enough. Update the device and security software, run a scan, remove untrusted extensions or profiles, and avoid entering new passwords on a device you do not trust.

Also consider where the session was created. A shared or public computer may retain browser data without the device being infected, while a personal device with an unknown administrator, profile, or extension needs deeper inspection. Revoke the server-side session in either case; local browser cleanup on one machine cannot remove a token already copied elsewhere.

If the alert was the only anomaly and official logs show no unknown session or change, you may not need to reset the device. Base the response on evidence rather than treating every approximate location as malware.

Summary

Verify through the official service, never through the alert link.
Treat location as one signal and look for devices, sessions, changes, and activity.
Secure primary email and financial accounts first.
Revoke sessions, change reused passwords, strengthen MFA, and verify recovery methods.
Inspect forwarding rules, third-party grants, transactions, messages, and contact impact.

FAQ

Does a login from another city prove I was hacked?

No. Services may show a nearby city, a mobile-carrier exit, a VPN exit, or a place you traveled through. Combine location with the device, time, session status, account changes, and activity.

Should I click “this wasn't me” in the email?

Open the official app or website independently instead. If the message is genuine, the same security event and response controls should appear inside the account.

Should I change the password before signing out sessions?

Do both. The order varies by service, but do not assume a password change revokes every token. Use the explicit “sign out other devices” or session-removal control.

What if I cannot sign in anymore?

Use the provider's official recovery page from a trusted device. Recover primary email first when other accounts depend on it, and preserve case numbers or recovery confirmations.

Why should I check email forwarding rules?

An attacker can forward future messages and password resets to another address even after you remove the visible session. Delete rules, delegates, or connected clients you did not configure.

Do I need to warn my contacts?

Warn them if messages, posts, or requests were sent from your account, or if the attacker accessed contact lists. Tell them to ignore unusual links, files, codes, or money requests.

Is MFA still useful after someone got in?

Yes, after you remove the attacker's sessions and verify the enrolled factors. Delete factors or trusted devices you did not add, then enroll a strong method you control.

Should I delete the security alert?

Keep it until you have recorded the time, device details, and case information. Do not rely on the alert's links, and avoid sharing screenshots that reveal personal or security data.

Disclaimer: This article provides general cybersecurity education, not legal, financial, forensic, or professional incident-response advice.

Sources

Google Account Help — See devices with account access — https://support.google.com/accounts/answer/3067630?hl=en
Federal Trade Commission — How To Recover Your Hacked Email or Social Media Account — https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account

Sources checked 4 October 2026.

Related articles:

Someone Logged Into My Account: What Should I Do?