Quick answer
If you suspect unauthorized login, immediately check active sessions and devices in your account settings, change your password and enable two-factor authentication. Then review your recovery email and phone number, as well as connected apps, and remove anything you do not recognize.
How to recognize the problem
- You receive a notification about a login from an unknown device or location
- You notice changes in your account that you did not make
- The login is successful even though you recently changed your password
- You receive unknown emails or friends complain that you are sending them strange messages
- The account suddenly signs you out or asks for re-verification
Most common causes
Leaked password
The password may have been exposed in a known data breach or you used it in multiple places. Attackers can then easily access the account.
Phishing attack
You entered your details on a fake page that looked like a login page. This gave the attacker your username and password.
Malware
Malware on your computer can intercept passwords or session cookies. Regular scanning is important.
Shared or public device
If you logged in on someone else's or a public computer and forgot to log out, someone else can use your session.
Weak or reused password
Using the same password on multiple services allows attackers to use it everywhere you used it.
Step-by-step fix
- 1
Check active sessions and devices
Sign in to your account and find the list of active sessions. On your Google account go to
myaccount.google.com>Security>Your devices. On your Microsoft account go toaccount.microsoft.com>Securityand open the sign-in activity overview. For Apple ID go toappleid.apple.com>Devices. Remove any devices you do not recognize. - 2
Change your password immediately
Choose a strong, unique password that you do not use anywhere else. If you use a password manager, generate a new password and save it. Changing the password does not automatically end all active sessions, so be sure to sign out of all sessions afterwards (see step 7).
- 3
Enable two-factor authentication (2FA)
In the security settings, enable 2FA. We recommend an authenticator app (e.g. Google Authenticator, Microsoft Authenticator) instead of SMS messages. Save backup codes in a safe place.
- 4
Check account recovery options
Attackers often add their phone number or recovery email. In the account settings, check
Recovery methodsorSecurity infoand remove anything you do not recognize. Add your current details. - 5
Review connected apps and access
Go to the list of apps that have access to your account (e.g. Google:
Security>Third-party apps with account access; Microsoft:Connected apps). Remove any apps you do not use or do not recognize. - 6
Check email filters and rules
Attackers can set up filters that redirect or delete your emails. In Gmail go to
Settings>Filters and Blocked Addresses; in Outlook go toSettings>Mail>Rules. Delete suspicious rules. - 7
Sign out of all devices
Use the
Sign out of all devicesorSign out all sessionsoption to end all active sessions. Then sign back in only on devices you control. - 8
Scan your computer for malware
Run an updated antivirus program and scan the entire system. Remove any threats found. If you suspect a serious infection, consider changing your password from another, clean device.
- 9
Notify contacts if there was abuse
If the attacker used your account to send messages, inform friends and colleagues to ignore suspicious messages. Also, report the incident to the administrator if it is a business account.
If you still suspect or the account is a business account
If you have completed all the steps and still see suspicious activity, contact the service support (Google, Microsoft, Apple). For business accounts (Microsoft 365, Google Workspace) be sure to inform your IT administrator because they can check audit logs and further restrict access. If the account was compromised, consider changing passwords on all other services where you used the same password. Also, check if your data has been leaked via a service like Have I Been Pwned and take precautionary measures.
How to prevent it
- Use unique passwords for each account and keep them in a password manager.
- Enable two-factor authentication on all important accounts.
- Regularly check active sessions and remove unknown devices.
- Do not click on suspicious links in emails and messages.
When to call a professional
If it is a business account, if you have multiple connected accounts or if you suspect that the entire system has been compromised, contact IT support. They can analyze logs in detail and prevent further damage.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
How do I know if someone has unauthorized access to my account?
Check the list of active sessions and devices in your account settings. Pay attention to unknown locations, devices and sign-in times. Also, check if recovery details have been changed or suspicious rules have been added to your email.
Is changing the password enough?
Changing the password is the first step, but it is not always enough. The attacker may have an active session or backup access methods. Therefore, be sure to sign out of all sessions, remove unknown devices and check recovery options and connected apps.
What if I cannot access my account because the attacker changed the password?
Use the `Forgot password` option and follow the recovery steps. If that also fails, contact the service support. For business accounts, inform your IT administrator who can reset the password and restore access.