PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your Apple ID or Google Account shows a new device being set up

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Treat this as a possible account takeover: deny the sign-in if you can, then change the password from a device you already trust. After that, remove any device, session, recovery detail, forwarding rule, or connected app you do not recognise.

Do not do these things

  • Do not tap “Approve” or “Allow” on any prompt you did not start.
  • Do not use links in alert emails or texts to “secure your account”; go through Settings, the app, or the account website you type yourself.
  • Do not reuse an old password or a small variation of one.
  • Do not try lots of different fixes on several devices at once; focus on the account that sent the alert.
  • Do not assume two-step verification has handled it; still check devices, sessions, recovery details, and email forwarding.

What to do now

  1. Move to a trusted device.

    • Use your own phone or computer, not a shared, borrowed, or public device.
    • Open Apple or Google settings directly, rather than following a link from a message.

  2. Deny the sign-in prompt if it is still on screen.

    • Apple: choose Don’t Allow if you see a sign-in notification you do not recognise.
    • Google: tap No or No, it’s not me if the prompt says the sign-in is not yours.

  3. Change the password right away.

    • Apple Account: change your password from Settings on your iPhone, iPad, or Mac, or from the official Apple Account page.
    • Google Account: change your password from your Google Account security settings.
    • Use a brand-new password you have not used anywhere else.

  4. Remove unknown devices and sessions.

    • Apple: check your Apple Account device list and remove anything you do not recognise.
    • Google: go to Security, or Security & sign-in, then Your devices → Manage all devices and sign out of anything you do not recognise.

  5. Check recovery details before the attacker can use them.

    • Apple: check that trusted phone numbers, trusted devices, email addresses, and other sign-in details are yours.
    • Google: check that the recovery email and recovery phone are yours.
    • Remove any phone number, email address, device, or sign-in method you did not add.

  6. Check for hidden continued access.

    • In Gmail, check for unfamiliar forwarding and filters that could send copies of your email elsewhere.
    • Check connected third-party apps and services, then remove anything you do not recognise.
    • If your mobile service suddenly stopped working, or you get SIM or number-change messages, contact your mobile network provider promptly.

  7. Check money-linked activity.

    • Look at recent purchases, subscriptions, and saved payment methods connected to the Apple or Google account.
    • If you see a payment you did not authorise, contact your bank or card provider immediately.

  8. Use official recovery if you cannot regain control.

    • Use Apple or Google’s official account recovery flow from a trusted device.
    • Avoid sponsored or lookalike search results; use the provider’s app, settings route, or official help pages.

  9. Report UK fraud or cyber crime if money, identity, or account access has been taken.

    • If you are in England, Wales, or Northern Ireland, use Report Fraud.
    • If you live in Scotland, or the crime happened in Scotland, contact Police Scotland on 101 for non-emergency reporting.
    • Use 999 only if there is an immediate emergency.
    • Keep a simple note of the time of the alert, what changed, and screenshots if you can take them safely.

What can wait

  • You do not need to work out how they got in right now.
  • You do not need to message the unknown device or person.
  • You do not need to reset every device today unless the provider tells you to or you keep seeing re-entry.
  • You do not need to decide about long-term reporting before you have secured the account, unless money is actively leaving your accounts.

Important reassurance

A new-device alert can feel urgent because it is designed to make you act quickly. A few focused steps can often stop the immediate sign-in, remove access, and make it harder for someone to get back in.

Scope note

These are first steps only, to interrupt a possible in-progress sign-in and reduce immediate harm. Later decisions may need help from Apple, Google, your mobile network provider, your bank, the police reporting service, or another specialist service.

Important note

This is general information, not legal, financial, technical, or professional advice. If you are unsure whether a prompt or message is genuine, close it or deny it, then go directly to your account settings from a trusted device.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us