Is someone else signed in to your account?

iPhoneAndroidMacWindowsUpdated

A sign-in alert from a place you've never been, a verification code you didn't ask for, or a device name you don't recognise in your account settings: it's unsettling, and it's worth checking properly. Apple, Google and Microsoft each keep a list of devices and sign-ins, and each lets you remove what isn't yours.

Quick answer

Check your account's device list. Apple: Settings > [your name], then scroll to your devices. Google: Security & sign-in > Your devices > Manage all devices, plus Recent security events. Microsoft: the Recent activity page. Remove anything you don't recognise, change your password and make sure two-factor authentication is on.

How do you check if someone is using your Apple Account?

Look at the devices signed in to it. Apple says a device on your account can, depending on the type, sync with iCloud, receive two-factor verification codes, edit personal information and change your password. The list includes Android phones, Windows PCs and streaming devices you've used with Apple services.

  1. On iPhone or iPad, open Settings and tap [your name], then scroll down to the list of devices.
  2. On a Mac, choose Apple menu > System Settings, then click [your name] and scroll down.
  3. On a Windows PC or Android phone, sign in at account.apple.com and select Devices.
  4. Select any device to see its details. If you don't recognise it, choose Remove from Account and confirm.

A removed device loses access to iCloud, Find My and other Apple services, and won't reappear unless someone signs in on it again. So change your password straight after.

What are the signs your Apple Account has been compromised?

Apple lists them: a notification or email about activity you don't recognise, such as a sign-in on an unknown device or a password change you didn't make; a two-factor code you didn't request; messages you didn't send or items deleted that you didn't delete; trusted devices you didn't add; or a password that no longer works.

If a sign-in alert appears with a map, Apple says the location is approximate, based on the IP address or network the other device is using. If you don't recognise it, select Don't Allow to block the attempt. You may want to take a screenshot first.

To take back control, Apple says:

  1. Change your Apple Account password. On iPhone, go to Settings > [your name] > Sign-In & Security > Change Password. When asked, tap Remove Other Devices to make every other device sign in again.
  2. At account.apple.com, correct any personal or security details you don't recognise, and remove unknown devices.
  3. Check with your email provider and mobile network that you control every email address and phone number on the account, including that SMS forwarding hasn't been set up.
  4. If you can't sign in or reset your password, go to iforgot.apple.com to start account recovery.

How do you see where your Google Account is signed in?

Google lists the devices where you're signed in now, or were in the last few weeks. It also has a Recent security events panel, where you can review activity and flag anything that wasn't you.

  1. Go to your Google Account and tap Security & sign-in.
  2. On the Your devices panel, select Manage all devices. Tap a device you don't recognise, then Sign out.
  3. Back on Security & sign-in, on the Recent security events panel, select Review security events.
  4. For anything that wasn't you, select No, it wasn't me, then follow the steps on screen.

Google says one device can show several sessions, and the times shown can include background syncing, so a recent time doesn't always mean someone used it.

What does Google's Security Checkup do?

Security Checkup gives you personal recommendations for your Google Account. Google says these cover your recovery phone and email, passkeys, 2-Step Verification, apps with access to your account and screen locks on your devices. A green shield on the Security & sign-in page means there's nothing urgent.

  1. Sign in to your Google Account.
  2. At the top right, click your profile picture, then Recommended actions.
  3. Work through each recommendation. If Recommended actions doesn't appear, Google has no recommendations for you.

Google also lists settings to check for unfamiliar changes: your recovery phone and email, the apps with access to your account, 2-Step Verification, and Location Sharing. In Gmail, check forwarding, filters and delegation. If someone has changed your password, use Google's account recovery page.

How do you check Microsoft account sign-in activity?

Microsoft's Recent activity page shows when and where your Microsoft account was used in the last 30 days. If there's an Unusual activity section, Microsoft asks you to confirm each item. Expand an entry to see the IP address, a map, the device or operating system, and the browser or app.

  1. Sign in to the Security basics page for your Microsoft account and select Review activity.
  2. In Unusual activity, expand an item and choose This wasn't me if it wasn't you, or if you're not sure. Microsoft will ask you to change your password and update your security info.
  3. In Recent activity, expand anything suspicious and select Secure your account.

Microsoft notes that mobile networks can make a sign-in look like it came from somewhere else, and travel or a new device can trigger an alert. Genuine Microsoft alerts come from account-security-noreply@accountprotection.microsoft.com. If you're not sure, sign in directly rather than clicking a link in an email. For signs someone used the computer itself, see how to tell if someone used your laptop.

What should you do after removing an unknown device?

The UK's National Cyber Security Centre gives the order: check your email filters and forwarding rules first, then change the password for the affected account and any account using the same password, then log all devices and apps out, and set up 2-step verification.

The NCSC says that with 2-step verification on, a criminal who knows your password still won't be able to get into your account. If you think a partner or someone close to you has your passwords and you feel unsafe, the National Domestic Abuse Helpline, run by Refuge, is free on 0808 2000 247. In an emergency, call 999.

Where Failshot fits

Failshot doesn't see your Apple, Google or Microsoft accounts, and doesn't detect sign-ins, hacking or remote access. The account pages above are where you check those. Failshot covers one thing: someone with your device in their hands. It photographs whoever unlocks your device while Failshot is on, and the camera light shows whenever it takes a photo.

On iPhone, you turn Failshot on and lock the phone, and whoever unlocks it lands in Failshot and is photographed. It doesn't photograph a wrong passcode at the iPhone Lock Screen. On Android it also photographs a wrong PIN, pattern or password, and on Mac and Windows it photographs whoever unlocks the computer. Switching it off never uses the device's passcode. Photos stay on your device. It's for your own devices only. It's out now for Mac, and coming soon to iPhone, Android and Windows.

Questions people also ask

Can someone use my Apple ID without me knowing?

Apple's two-factor authentication is designed so a password alone isn't enough: signing in on a new device needs a code shown on your trusted devices. Apple notifies you of sign-ins on devices you don't recognise. Check your device list in Settings > [your name] to be sure.

Why is there an unknown device on my Google Account?

It may be yours. Google says a new device, a public computer you used, or a device you recently reset can all appear, and locations can show a nearby place. If you still don't recognise it, sign it out and change your password.

What happens when I remove a device from my Apple Account?

Apple says it loses access to iCloud, Find My and other Apple services, and two-factor codes stop showing on it. It won't reappear unless someone signs in on it again, so change your password too.

I got a two-factor code I didn't ask for. What now?

Apple lists a two-factor code you didn't request as a sign your account may be compromised. Change your Apple Account password from a device you trust, review your device list, and choose Don't Allow on any sign-in alert you don't recognise.

Sources