All incidents
I've noticed unknown activity on my account
You've spotted a login, purchase, message, or change you didn't make. This can indicate that someone else has access to the account, or it could have a simpler explanation like a family member or an old logged-in device.
Do this now
- Change the account password immediately, using a strong, unique one.
- Check for and remove any active sessions or devices you don't recognise.
- Turn on multi-factor authentication (MFA) if it isn't already on.
Then do this
- Review recent changes to recovery email, recovery phone number, or security questions, since attackers often change these first.
- Check connected third-party apps and remove anything you don't recognise or no longer use.
Check these things
- Has the recovery email or phone number changed recently?
- Are there login locations or devices you don't recognise?
- Have any settings, forwarding rules, or connected apps changed?
Don't do this
- Don't assume it's nothing without checking the account's activity log.
- Don't delay changing the password while you investigate.
When should I get help?
- Contact the service provider's support if you can't secure the account yourself.
- Contact your bank if the account is linked to any payment method.