What to do if… you get a security alert about a new sign-in from an unknown device

uk Technology & digital loss security alert new sign-in • unknown device login • unrecognized sign-in notification • new device sign-in alert • was this me sign-in • account takeover warning • suspicious login email • sign-in from new location • compromised account check • someone accessed my account • unexpected verification code • password changed without me • email account compromised • google security alert • microsoft unusual sign-in • apple account sign-in prompt • two step verification setup • sign out of all devices • recovery email changed • account security review

Short answer

Treat it as real until you’ve checked it yourself: go directly to the service (don’t use links in the alert), review the sign-in details, and if it wasn’t you, secure the account immediately (password change + sign out everywhere + turn on 2-step verification).

Do not do these things

Don’t click “confirm/deny” links in an email/SMS alert unless you opened the service by typing the address/app yourself.
Don’t “test” passwords by trying variations (you can lock yourself out or trigger more risk).
Don’t ignore it because the location/device looks “sort of” plausible (locations can be misleading).
Don’t reuse an old password, or change it to something similar.
Don’t do account recovery while you’re on public/shared Wi-Fi or a shared computer if you can avoid it.

What to do now

Pause and verify the alert safely (30–60 seconds).
Open the app or type the website address yourself (or use a known bookmark). Find Security / Recent activity / Devices and locate the exact sign-in: time, device type, browser/app, and approximate location.
If there’s any chance it wasn’t you: take the “secure my account” option inside the service.
Many services have a built-in option such as “No, secure account” / “This wasn’t me” that triggers protective steps (ending sessions, forcing a password change, extra checks).
Change the password for that account right away (from a device you trust).
Use a new, unique password you’ve never used anywhere else. If you reused that old password on other accounts, plan to change those next (start with email and banking/payment accounts).
Force sign-out on other devices and remove anything you don’t recognise.
In the account security settings, choose options like “sign out of all devices”, “log out of apps”, remove unknown devices, and revoke access for unfamiliar third-party apps.
Turn on 2-step verification (2SV) for the account (and your email).
Use an authenticator app or device prompt if available. If you can, avoid relying only on SMS.
Check your recovery and contact details for “quiet” changes.
Confirm your recovery email/phone, backup codes, and security questions. If anything was changed, fix it and re-secure the account.
If this is your email account: check forwarding rules and filters.
Look for auto-forwarding, “rules”, “filters”, or “delegates” you didn’t set up (attackers sometimes use these to keep receiving your mail even after you change a password).
If the account is for work/school, stop and involve the right people.
Use your organisation’s official IT/security channel and follow their process; they may need to reset sessions or investigate centrally.
Capture minimal evidence, then move on.
Take screenshots of the alert/sign-in details (date/time/device/location) and any changes you notice. Don’t get stuck investigating while the account is still at risk.
If you’ve lost money or your account was used to scam others, consider reporting through UK police reporting routes.
In the UK, cyber crime and fraud are typically reported online via Report Fraud (the national reporting service). If you’re in Scotland, reporting routes can differ; for non-emergencies, Police Scotland is commonly contacted via 101.

What can wait

You don’t need to figure out how it happened right now.
You don’t need to secure every account you’ve ever had today—prioritise: email → password manager (if you use one) → banking/payment → primary socials.
You don’t need to argue with anyone who messages you about it; you can respond later once you’re secure.
You don’t need to factory reset devices unless you keep seeing new sign-ins after you’ve secured the account.

Important reassurance

These alerts are designed to make you react fast, and it’s normal to feel shaky or angry. You’re not “too late” just because you saw one sign-in—quick, boring steps (verify, secure, sign out, 2SV) are exactly what limits damage.

Scope note

This is first steps only: it focuses on regaining control and stopping further access. If you keep getting new sign-in alerts after doing the steps above, you may need device checks and deeper recovery with the account provider.

Important note

This is general information, not legal or professional advice. If you think criminal activity is involved (especially fraud or financial loss), follow the service’s official recovery steps and use official UK reporting routes.

Additional Resources

Support us

What to do if…you get a security alert about a new sign-in from an unknown device