When an account security alert arrives, do not use the message's link, phone number, attachment, or reply button to investigate. Open the provider's official app or type its known account address yourself, then review recent security activity, devices, sign-in methods, recovery details, and connected apps. If the event is unauthorized, contain it from a trusted device and follow the provider's recovery process.
Preserve the alert without acting through it
Take a screenshot or save the message details, including sender, time, claimed device, location, and action. Do not forward a suspicious alert with active links to other people. Note whether you recently traveled, signed in on a new device, installed an app, changed a recovery method, or used a privacy service that could explain the event.
Security alerts can be real, but copied alerts are also a phishing tactic. Google's suspicious sign-in guidance says copied warning messages may try to steal account information and directs users to review events from the Google Account security page. The safe habit is to navigate independently to the provider rather than trusting the message itself.
Review the event at the official account page
Use a device you trust. Open the provider's app or enter its official domain from a saved bookmark. Find recent security activity and compare the time, device, browser, approximate location, and sign-in method with your own actions. A location can be approximate, and background app sessions can produce unfamiliar-looking details, so use several facts before deciding.
Google's compromised-account guide directs users to review recent security events and managed devices and to mark activity that was not theirs. Microsoft's unusual sign-in guide similarly directs users to Recent activity and provides controls to report an event or secure the account.
Check devices and sessions, recovery email and phone, multifactor methods, passkeys, app passwords, forwarding rules, delegated access, and third-party applications. An alert about one sign-in can be accompanied by a changed recovery method or a new mail-forwarding rule.
Contain activity you do not recognize
Use the provider's secure-account flow. Change the account password from the official settings, revoke unfamiliar sessions, remove unknown recovery or sign-in methods, and disconnect unrecognized apps. If the same password was reused elsewhere, change those accounts too, starting with email, password managers, financial services, and accounts that can reset other credentials.
Do not remove your only working recovery method before a replacement is confirmed. If you have lost access, use the provider's official account-recovery page from a device and location you commonly use. Never pay a stranger who claims they can recover the account.
If the account contains payment activity, sensitive messages, business administration, or personal data, review those areas for unauthorized changes. Preserve evidence before deleting suspicious rules or messages when fraud, workplace reporting, or law enforcement may be involved.
If the activity was yours
Mark it as recognized only from the official activity screen. Confirm that recovery contacts and multifactor methods remain current. An expected alert after travel or a new device is not a reason to ignore future warnings; it is a chance to verify the alert channel and update the account inventory.
Record the device or app that generated the event so another household member or administrator does not repeat the investigation. If alerts are going to an old phone number or address, update the security contact through the account settings.
Close with verification
Sign out and back in using the intended method, verify multifactor authentication, and review the activity page again. Check that unfamiliar sessions, apps, and forwarding rules are gone. Monitor the account and connected services for follow-on alerts or transactions.
Write a short incident note: provider, alert time, independent verification path, finding, changes made, evidence retained, and next review date. The goal is not merely to dismiss a message; it is to establish whether the account changed and leave its recovery paths stronger than before.
Sources
- Suspicious sign in prevented email — Google Account Help
- Secure a hacked or compromised Google Account — Google Account Help
- What happens if there is an unusual sign-in to your account — Microsoft Support