TL;DR: Most email providers send a "new sign-in" or "new device" alert to your inbox or as a security notification when your account is accessed from an unrecognized device or location — that alert, or one you don't remember triggering yourself, is the sign to check. Check your account's recent security activity (Google: Security > Your devices; Outlook/Microsoft: Security > Sign-in activity; Apple: Settings > [your name] > Devices), sign out of any device you don't recognize, and change your password immediately with two-factor authentication enabled.
Most email providers send a "new sign-in" or "new device" alert to your inbox or as a security notification when your account is accessed from an unrecognized device or location — that alert, or one you don't remember triggering yourself, is the sign to check.
What Usually Causes This
This typically happens when your password was compromised in a data breach and reused, or when a phishing email tricked you into entering your login details on a fake page.
What to Do About It
Check your account's recent security activity (Google: Security > Your devices; Outlook/Microsoft: Security > Sign-in activity; Apple: Settings > [your name] > Devices), sign out of any device you don't recognize, and change your password immediately with two-factor authentication enabled.
If this looks similar to something else you've seen, it's worth reading How to Check If Your Browser Has Been Hijacked.
This pattern shows up elsewhere too — see How to Check If Your VPN Is Actually Working.
Frequently Asked Questions
What are the real warning signs?
Most email providers send a "new sign-in" or "new device" alert to your inbox or as a security notification when your account is accessed from an unrecognized device or location — that alert, or one you don't remember triggering yourself, is the sign to check.
What usually causes this?
This typically happens when your password was compromised in a data breach and reused, or when a phishing email tricked you into entering your login details on a fake page.
What should I do about it?
Check your account's recent security activity (Google: Security > Your devices; Outlook/Microsoft: Security > Sign-in activity; Apple: Settings > [your name] > Devices), sign out of any device you don't recognize, and change your password immediately with two-factor authentication enabled.
Should I be worried if I only see one sign?
One sign alone (like a slower device) is usually not cause for alarm — most single symptoms have mundane explanations. Multiple signs together, especially unexpected data usage or unfamiliar apps, are worth investigating.