Review the session, not just the alert.
- 01
Alert context
Open security settings independently of the alert link.
What this tells youYou are reviewing the account through an independent route.
A message that looks like a security alert can still contain an untrusted link. Open your own account settings directly.
- 02
Sessions
Review sessions you do not recognize.
What this tells youYou have compared a session with your actual device use.
Note the device, browser and time together. A familiar device description alone is not proof that you authorized every use.
- 03
Account security
Secure your email and account if there is evidence of unauthorized access.
What this tells youEvidence of unauthorized access leads to a security response.
Protect the linked mailbox and follow official recovery guidance when the account is no longer under your control.
Give each signal the right weight.
| Signal | Useful comparison | Limit |
|---|---|---|
| Device or browser | Compare it with devices you use or previously borrowed. | A label is not a person’s identity. |
| Time of activity | Compare with your own recent sign-ins. | Remembered access can complicate interpretation. |
| Approximate location | Read alongside device and timing context. | It is not a precise location trace. |
| Changed messages or settings | Record what you did not authorize. | A location mismatch alone is a weaker signal. |
Two sessions. Two different decisions.
A remembered browser on a work computer and a newly unknown device deserve different decisions.
A browser you remember
You used a work computer yesterday. Compare the session time with that use, and decide whether you still need it signed in.
A session you cannot explain
The device and timing do not fit. Review the account for other changes and use official security guidance if access was unauthorized.
Before ending a session, check the context.
A review you can act on
Compare the browser, timing and your own use. Keep location in context.
Read what the current sign-out control will affect and confirm the selected session.
Make sure you retain authorized account-recovery access. A session ending is not itself a complete incident review.
Unexpected messages or changed recovery details? Continue with the account-hacked guide →
Keep this boundary.
Do not accuse someone based only on an approximate location label.
Review only accounts and devices you are authorized to manage. Preserve relevant incident context before making changes.
References and current instructions
Go to the source.
Device labels and feature availability can change; use the current official page before taking action.
Official owner-account recovery guidance; a familiar device can help.
Official account and contact-management topics.