'New device login' email you didn't trigger? Here's what to do

EP
Erropedia Team
📅 June 22, 2026 📅 Updated Jul 31, 2026 👁 12 views Cybersecurity & Malware Beginner
Got a login verification email you didn't ask for? Someone may have your password. Here's how to check and lock things down fast.

Quick check (30 seconds): Is this email real or fake?

First thing: don't click anything in the email yet. What's actually happening here is scammers send fake security alerts to trick you into logging in on their fake page. So you need to verify the email is genuine before doing anything else.

Look at the sender address. Not just the name – the actual email address after the @. For Google it's no-reply@accounts.google.com. For Microsoft it's account-security-noreply@accountprotection.microsoft.com. For Apple it's no-reply@apple.com. If it's something like security-google@gmail.com or admin@secure-login.net, it's fake – delete it and move on.

Also check where the 'Verify this device' or 'Review activity' link goes. Hover over it (don't click). On a phone, press and hold. Real links go to https://myaccount.google.com or https://account.live.com. Fake links go to weird domains like google-verify.com.

If you're still unsure, open a private browser window and manually type myaccount.google.com (for Google) or account.microsoft.com (for Microsoft). If you see a security alert there, the email was real. If not, it was a fake.

Moderate fix (2–5 minutes): Real alert – lock it down

So the email is real. That means someone has your password. They might not have gotten in yet if you have two-factor authentication (2FA), but they have enough to try. Here's the fix.

  1. Change your password immediately. Do it from a trusted device, not from the email link. Make it long – at least 16 characters. Use a password manager if you have one. Don't reuse this password anywhere else.
  2. Sign out of all other sessions. After changing the password, most services let you force sign-out everywhere. On Google it's under Security > Your devices > Manage all devices > Sign out of all other sessions. On Microsoft it's under Security > Sign-in activity > Sign out everywhere. This kills the attacker's session if they already got in.
  3. Enable two-factor authentication if it's not on. This is the real fix. Even if someone gets your password later, they can't log in without your phone. SMS-based 2FA is okay, but an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) is better. Security keys (YubiKey) are best – but that's overkill for most people.
  4. Check recent login activity. Look for locations or devices you don't recognize. On Google: Security > Recent security activity. On Microsoft: Security > Sign-in activity. On Apple: Settings > Password & Security > Account Security. If you see a login from a country you've never visited, that's a problem.

The reason step 3 works is that the attacker already has your password. Changing the password removes their current access, but if they compromised your email or phone, they could get it again. 2FA stops that – they'd need both your password AND your phone.

Advanced fix (15+ minutes): Full cleanup and prevention

If you're still worried, or this keeps happening, you need to go deeper. Skip this if you're not technical or if the moderate fix stopped the alerts.

  1. Check for app passwords or OAuth apps you don't recognize. Attackers sometimes create app-specific passwords or grant third-party apps access to your account. On Google: Security > Third-party apps with account access. On Microsoft: Security > App passwords. Revoke anything you don't use or don't recognize.
  2. Scan your devices for malware. If an attacker has your password, they might have a keylogger or a session cookie stealer on your computer or phone. Run a full scan with Malwarebytes or Windows Defender. On a Mac, run Malwarebytes for Mac. On a phone, check for apps you didn't install – especially ones with names like 'System Update' or 'Battery Saver'.
  3. Set up a recovery email and phone number. If you lose access to your account, you'll need these to get back in. Make sure they're accounts you actually check.
  4. Consider a password manager. People who reuse passwords across sites get compromised faster. LastPass, Bitwarden, 1Password – any of them will generate and store unique passwords for each site. Pick one.
  5. Enable passkeys or passwordless login. This is the future. Google and Apple now support passkeys – you log in with your face or fingerprint instead of a password. No password to steal. Enable it under Security > Passkeys on supported services.

That's it. If you did the moderate fix, you're safe. The advanced fix is for people who want to be paranoid-level safe. Don't skip the 2FA step – it's the single best thing you can do.

Related Errors in Cybersecurity & Malware
Locked Out of 2SV? Recover Without Backup Codes 0X80091007 CRYPT_E_HASH_VALUE (0X80091007): What Actually Causes It TI_FEED_SYNC_0001 Threat Intel Feed Sync: Stuck at 'Initializing' 0X80090340 Fix SEC_E_KDC_INVALID_REQUEST (0x80090340) in 2 Minutes
new device login email login attempt from new device verification email scam email phishing account compromise security alert email unauthorized login attempt change password immediately enable two-factor authentication check login history Google account suspicious activity Microsoft account sign-in alert Facebook login notification Apple ID verification email device authorization

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.