uk Technology & digital loss

What to do if…
your account shows an unknown login, trusted device, or new sign-in

Produced and maintained by PanicStation.org Published: 24 July 2026 Last reviewed: 16 August 2026 Editorial policy UK guide

Short answer

Open the service through its official app or website rather than through the alert. Check the account activity and, if you cannot explain the login or device, change the password, sign out other sessions, and secure the email account linked to it.

Do not do these things

Do not click links or call numbers in an unexpected login alert.
Do not approve a sign-in, verification prompt, or password reset that you did not start.
Do not share a password, backup code, or verification code with anyone.
Do not reuse an old password or one used for another account.
Do not assume the displayed location identifies exactly where a login happened, as location information can be approximate.
Do not remove every device before recording the unfamiliar activity you may need to describe to the provider.
Do not delay contacting your bank or payment provider if you see unfamiliar transactions.

What to do now

Using a device you trust, open the provider’s official app or type its website address yourself. Go to the account’s security or activity settings.
Check the date, time, device type, browser, approximate location, active sessions, trusted devices, connected apps, recovery details, and recent security changes.
Consider whether the activity could be yours. Recent travel, mobile data, a VPN, a renamed device, or an old, shared, repaired, sold, or work device may make an entry look unfamiliar.
If you still cannot explain the login or device, take a screenshot or note the visible details. Do not record or share passwords, verification codes, or backup codes.
Change the account password. Use a new, strong password that you have not used for another account.
Use the provider’s security settings to sign out other devices or sessions. Remove any trusted device, connected app, passkey, recovery method, or other access you do not recognise.
Turn on two-step verification if it is available. Review the registered phone number, authentication app, security keys, backup codes, and recovery email so that only your details remain.
Secure the email account linked to the affected service. Check its recent activity, active sessions, recovery details, filters, and forwarding rules, then change its password if the activity is unexplained or the password was reused.
Change the password on any other important account where you used the same password. Prioritise email, banking, payment, shopping, cloud-storage, and social-media accounts.
Contact the account provider through its official support or recovery page if you cannot regain control, change the security settings, or remove the unfamiliar access.
Check for actions you did not take, including sent messages, purchases, transfers, changed contact details, deleted files, new users, forwarding rules, or altered security settings.
Contact your bank or payment provider immediately through its official app, website, or the number on your card if money or payment details may be at risk.
Briefly warn relevant contacts if suspicious messages or payment requests were sent from the account. Ask them not to open links, share codes, or send money.
Report the incident to Report Fraud if you are in England, Wales, or Northern Ireland and it involves fraud or cyber crime. In Scotland, report fraud to Police Scotland on 101. Call 999 if anyone is in immediate danger.

What can wait

You do not need to identify who accessed the account, investigate every past login, close all your online accounts, or decide whether every old device is unsafe right now. First regain control of the affected account, secure the linked email, and protect any money or sensitive information at immediate risk.

Important reassurance

An unfamiliar login, device, or location does not always mean that another person has accessed the account. Services may show approximate locations, old sessions, renamed devices, mobile-network addresses, or VPN activity. Treat the entry seriously, but work through the account settings in order rather than making irreversible changes in panic.

Scope note

This guide covers immediate steps to check and contain possible unauthorised account access. Later decisions may require help from the account provider, your employer, your bank, the police, a fraud-reporting service, or a cyber-security specialist.

Important note

This is general information, not legal, financial, technical, or professional advice. Security controls and recovery processes vary between providers, so follow the provider’s current official instructions.

Additional Resources

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us