Account security
How Can I Tell If Someone Accessed My Account
Account access leaves traces: new devices, reset mail, forwarding rules, and charges you did not make. Here is how to read those traces without panic.
The difference between a leak and a login
A data exposure means information appeared in a known incident. A login means someone completed the steps the service uses to open the account. Those events can travel together. They are not the same thing. Your email can appear in an old file while every current session still belongs to you. The reverse is also possible: a takeover can start from a reused password, a stolen session cookie, a SIM swap, or a convincing reset page, even if you never saw a headline about that company. So when you ask how can I tell if someone accessed my account, look at the account’s own records first.
Clues that deserve a real security review
Open the official security, privacy, or devices page and look for:
Also read the mailbox that receives security alerts. Attackers who get in often try to delete those messages or forward them away. The FTC notes that a stolen password or login can be used to sign in, shop, impersonate you, send spam, or reach other personal information connected to that account.
- Sessions or devices you do not own
- Logins at hours when you were asleep, if that pattern is new
- A recovery email, phone number, or passkey you did not add
- Mail forwarding, filters, or inbox rules that hide messages
- Sent mail you did not write
- Purchases, transfers, address changes, or tax-form requests you did not start
- Disabled multifactor authentication you had turned on
What those clues do not prove by themselves
Travel, a VPN, a shared family computer, and app bugs can create strange location labels. A spouse or roommate may have used a saved login. An old phone can still show up as a trusted device. Use context. If you did not travel, do not share the account, and see a new recovery mailbox plus a reset email, treat it as unauthorized access until the official provider says otherwise.
If you think someone was inside
Stay on official channels.
Write down dates, device names, and what you changed. That record helps support teams and, if needed, an identity-theft report.
- Change the password from a device you trust.
- Turn MFA back on. Add a passkey or security key if the service allows it. CISA recommends MFA on email, social, shopping, and financial accounts, and prefers stronger methods than a simple text when they are available.
- Sign out all sessions, then sign back in only on devices you control.
- Remove unknown phones, recovery addresses, and third-party apps.
- Check forwarding and filters if the account is email.
- Call the bank, broker, or payroll provider using the number on the card or the official site if money movement is possible. Investor.gov gives the same first-line advice for investment accounts: contact the firm immediately.
- If someone opened credit, filed a tax return, or used your identity in another way, report it at IdentityTheft.gov and follow the recovery plan.
Email is the master key — inspect it first
Many “someone accessed my shopping account” cases start as “someone sat in the mailbox long enough to request a reset.” On the official webmail settings page, confirm:
Then look at the accounts that mailbox can reset. That list is your real blast radius.
- Recovery phone and backup address
- Connected apps
- Automatic forwarding
- Filters that send mail to trash or a label you never open
- Recent security activity
After you regain control
Watch statements for a full billing cycle. Review credit reports at AnnualCreditReport.com if financial or government identifiers may also have been used. A credit freeze can make it harder for someone to open new credit in your name; the FTC explains fraud alerts and freezes as tools for that situation. Do not pay a stranger who claims they can “kick the hacker out” for a fee. Use the provider’s posted support path. If you still need a simple rule: how can I tell if someone accessed my account is answered on the official security page, not in a panic link.
Practical checklist
- Open official security settings, not an email link.
- Review devices, sessions, recovery methods, and rules.
- Change the password and enable MFA or a passkey.
- Sign out everywhere.
- Inspect the mailbox that resets other accounts.
- Contact banks using known numbers if money is in play.
- Use IdentityTheft.gov if identity misuse is confirmed.
- Keep notes of what you saw and what you changed.
Frequently asked questions
Can a location label be wrong?
Yes. Treat location as one clue among several, not as courtroom proof.
Should I destroy the phone after a suspected login?
Usually no. Sign out sessions, change passwords, update the phone, and remove unknown devices. Replace the phone if you believe the device itself is compromised and the provider confirms that path.
Is a password-reset email proof of takeover?
It is proof that someone tried to use the reset path. Check whether the reset completed and whether new sessions appeared.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.