How to Secure an Email Account After a Suspicious Login

After a suspicious email login, open the official email provider website or app, change a weak or reused password, sign out of unknown sessions, turn on multifactor authentication, and review recovery settings. Do not click links in a suspicious alert until you verify it through the provider directly.

A suspicious login may be a real blocked attempt, a successful sign-in, a travel or VPN-related alert, or a phishing message pretending to be your provider. The response is the same at the beginning: verify from a trusted path and protect the account.

Your email deserves priority because it often receives password reset links for banking, cloud storage, social media, shopping, and work accounts. The FTC highlights that email access can let someone reset other accounts.

Some alerts mean the provider detected a sign-in from a new device, browser, or location. Others mean someone tried a password and failed. Some mean a successful login occurred and needs review. Phishing messages may imitate all of these.

Do not judge only by the logo, urgent language, or sender display name. Instead, go to the official account security page and look for recent activity.

If you cannot access the account, use the provider's official recovery process. Apple, Google, and Microsoft all publish account recovery and account security guidance for their own platforms.

An email exposure check can help explain whether your address is appearing in known breach data and may be targeted. It can also show whether older exposed credentials might be relevant.

Only check identifiers you own or are authorized to manage. Never enter your current email password, authentication code, Social Security number, payment card number, passport number, or bank details into an exposure checker.

A negative result does not guarantee safety. It only means no known match was found in the sources searched.

If the suspicious login involves financial loss, workplace systems, threats, or identity misuse, take simple notes before changing settings. Record dates, alert text, devices shown, locations shown, and actions you take.

Do not download suspicious attachments or search for raw breach data. Keep your record focused on what you can see in your official account pages.

Change the email password from the official provider site. Use a unique password that you do not use on any other service. If you reused the old password elsewhere, change those accounts too, starting with the most important ones.

NIST recommends password managers because they help users create and store strong unique passwords. Avoid small variations of the old password because predictable changes are easy to test.

Enable MFA as soon as possible. CISA recommends MFA because it adds another verification step beyond the password. Use a security key, passkey, or authenticator app when available.

If text-message codes are the only option, use them, but also protect your mobile carrier account with a PIN or port protection if your carrier supports it.

Review active devices and recent sessions. Sign out anything you do not recognize. If the provider offers 'sign out everywhere,' consider using it after changing the password.

Then review connected apps, delegated access, app passwords, browser extensions, and mobile mail apps. Remove anything you no longer use or do not recognize.

Review forwarding, filters, inbox rules, send-as settings, signatures, automatic replies, and recovery email or phone. Gmail guidance specifically tells users to check forwarding and filters, and Microsoft lists suspicious rules and forwarding as important mailbox compromise indicators.

If you find an unknown rule, remove it and search for messages it may have hidden. Pay special attention to password reset emails, financial alerts, and security notices.

Because your email can reset other accounts, review your most important services. Start with banking, payment apps, cloud storage, social media, work systems, and any account with private documents.

Look for unfamiliar recovery changes, unknown devices, and messages you did not send. If an account shows suspicious activity, use that platform's official recovery path.

If money was stolen, identity information was misused, or a scam occurred, use official reporting resources. The FTC provides identity theft recovery guidance, and the FBI IC3 accepts internet crime complaints.

For the next few weeks, expect possible phishing. Scammers may use the alert event to pressure you into clicking fake security messages. Verify through official apps and websites.