Check who has been signing into your email account

Your email account can be used to reset passwords for many of your other online accounts, so an unfamiliar sign-in deserves prompt attention.

For a Google or Gmail account

1. Go directly to google.com/devices.
2. Review the devices and sessions shown.
3. Select anything you do not recognise and sign it out.

Google may show several sessions for one device, and background syncing can make an activity time appear more recent than expected. Check the details rather than relying on the name alone.

For a personal Microsoft or Outlook account

1. Go directly to account.microsoft.com/security.
2. Open Recent activity or Review activity.
3. Examine unfamiliar locations, devices and successful sign-ins.
4. Select This wasn’t me or Secure your account when appropriate.

Microsoft’s recent-activity page normally covers the previous 30 days.

If something is not yours

Change the account password, enable two-step verification and check that the recovery email address and telephone number are still yours. Avoid following a link in an unexpected security-alert email; type the official account address into your browser yourself.