What to Do When You Get a "Suspicious Login" Alert

Google, Facebook, and banks send alerts when someone logs into your account from a new device. Here is how to tell if it was you — and what to do if it was not.

In this guide (4 steps):

1.Read the alert carefully to identify what happened
2.Verify the login by checking your account directly
3.If it was NOT you — act immediately
4.Prevent future unauthorized access

Read the alert carefully to identify what happened

~42s

A legitimate login alert from Google, Facebook, or a bank includes: the date and approximate time of login, the city/region and device type ("Windows PC in Phoenix, AZ" or "iPhone in Chicago"), whether the alert is from the service itself (check the sender email address carefully — fake alerts come from look-alike addresses). Ask yourself: Was I in that city recently? Was I using that type of device? Did I just log in somewhere new? If the answer is "yes, that was me," no action is needed.

Quick Tip

Quick Tip: If you receive an alert about a login that seems suspicious, do NOT click links inside the alert email — go directly to the service's website by typing the address in your browser. Clicking email links is how phishing attacks work.

Verify the login by checking your account directly

~26s

Go directly to the service (type google.com, facebook.com, etc. in your browser — don't use a link from the email). Sign in. Look for "Security" or "Account Activity" settings. On Google: myaccount.google.com → Security → "Your devices" and "Recent security activity." On Facebook: SettingsPassword and Security → "Where you're logged in." Review the list for unfamiliar devices or locations. If you see an active session you don't recognize, there may be an intruder.

If it was NOT you — act immediately

~38s

If you see an unfamiliar login: change your password immediately (use a strong, unique password). Log out all other devices — in Google: myaccount.google.com → SecurityYour devices → click each unfamiliar device → Remove. In Facebook: SettingsPassword and Security → "Where you're logged in" → click the device → "Log out." Turn on two-factor authentication right away if it is not already enabled. Contact the service's support if you cannot access your own account.

Warning

A genuine suspicious login alert from a legitimate company will never ask for your password or payment information. If an alert email asks for your password or a fee to "restore" your account, it is a phishing scam.

Prevent future unauthorized access

~27s

After securing your account: turn on two-factor authentication (requires a code from your phone for any new login). Use a unique password for this account — never reuse passwords across multiple sites. Consider a password manager (like Bitwarden, free) to generate and store strong unique passwords. Set up account activity alerts so you are notified of future logins. Check if your email address was in a data breach at haveibeenpwned.com — a free, safe service that tells you if your email appeared in known breaches.

You Did It!

You've completed: What to Do When You Get a "Suspicious Login" Alert

Need more help? Get Expert Help from a TekSure Tech

You receive an email from Google, Facebook, your bank, or another service: "We noticed a new sign-in to your account" or "Suspicious activity detected." Your heart rate goes up. Is someone in your account? Should you panic?

Most of the time, these alerts are triggered by routine activity that just looks unusual — signing in on a new device, traveling to a different city, or using a different browser. But sometimes they indicate a real intrusion, and knowing how to tell the difference — and what to do in each case — can protect your accounts.

This guide walks through how to respond to login alerts from the most common services.

Rate this guide

How helpful was this guide?

suspicious login

account security

new device alert

account compromise

google

facebook