A suspicious login or unusual sign-in alert means your email provider noticed a login that did not match your normal pattern, such as a new device, location, IP address, or browser. Often it is simply you, after traveling, getting a new phone, or using a VPN. But it can mean someone with your password is trying to get in. Check the details, and if the login was not you, change your password immediately.
Why this happens
- You signed in from a new device or browser, or after clearing cookies.
- You are using a VPN, a new network, or are traveling, which changes your apparent location.
- An app re-authenticated to your account.
- Someone else actually has your password and attempted a login, which is the real threat.
- The message itself is a fake alert designed to scare you into clicking a phishing link.
Is this normal?
Genuine alerts are common and usually harmless, since they often reflect your own new activity. Even so, it is worth confirming the login was really you rather than assuming.
Does it cause any problems?
If the login truly was someone else, your email and everything it can reset, such as bank and social accounts, are at risk. There is also the separate danger of fake alert emails that phish your password, so treat unexpected messages carefully.
How to fix or check it
- Do not click links in the alert email. Open the provider's official site or app yourself.
- Review the recent security and login activity. In Gmail, check Last account activity and Security, Your devices; in Outlook, check Security, Recent activity.
- If you recognize the device and location, no action is needed; mark it as you.
- If it was not you, change your password to a strong, unique one right away.
- Turn on two-factor authentication, preferably an authenticator app or a passkey.
- Sign out of all other sessions and devices.
- Check your filters and forwarding rules for anything you did not set, since attackers often add them.
- Confirm your recovery email and phone number have not been changed.
Frequently asked questions
The alert might be fake, so how do I tell?
Do not trust links in the message. Log in through the official website or app and check the account's own activity page instead.
Does this mean I was hacked?
Not necessarily. It is often just your own new device or location. Verify the activity before assuming the worst.
What if the login shows another country?
If you did not travel or use a VPN, treat it as a likely breach and change your password immediately, then review your recovery settings.