What to do in case of a suspicious login alert

Informatec Digital » Resources » What to do in case of a suspicious login alert

You receive a message on your phone or email: “We’ve detected a suspicious login to your account .” It mentions an unfamiliar city, an unusual device, or a strange IP address. It’s normal to feel alarmed, but the important thing is to react sensibly: neither ignore the warning nor succumb to the panic that many cybercriminals try to exploit.

In this article you will find a very complete guide on what to do in the event of a suspicious login alert , how to distinguish whether the alert is legitimate or a phishing attempt, what steps to take if someone has accessed your account, and how to secure your Google, Microsoft, social media, email, and other online service profiles to make it much harder for it to happen again.

What is a suspicious login and why are you receiving these alerts?

Most major platforms (Google, Microsoft, social networks, banks, online stores, etc.) have systems that continuously analyze how you use your account to detect unusual behavior . When something doesn't match your typical usage pattern, they send you a security alert.

In the case of Google Workspace, for example, the system can detect when a user tries to log in from an unusual country, at an unusual time, or with a different type of device than usual . Even before notifying the administrator, Google often requires the user to complete extra verification steps (security questions, confirmation from another device, etc.). If the person fails to prove their legitimacy, the administrator is alerted that someone may have access to the account password.

Microsoft does something very similar: if it detects a login from a new location or an unknown device, it sends an email and an SMS . That's why it's so important to keep your recovery phone number and email address up to date in the security settings of your Microsoft account, because these will be the ways to help you regain access if something goes wrong.

Other smaller services and social networks also use similar systems. You might see messages like “we’ve detected suspicious access to your account” when you log in from a new mobile device, from another country, or even when you change your IP address using a VPN.

Clear examples of suspicious logins

To better understand what triggers these notifications, it's helpful to look at some typical cases where platforms mark an access as suspicious because it deviates from your normal usage pattern or involves a clear risk.

One of the most common scenarios is when a user logs in from a location that isn't their usual one . If you normally connect from Spain and, suddenly, there's an attempt from another country, or even from a very distant city, the security systems consider it unusual, even if you're traveling.

It's also common for logins from a new device to be flagged as suspicious , such as a brand-new phone, a laptop that has never used that account before, or a browser with no cookies or previous data. Even if it's you, the platform doesn't yet "trust" that device.

Another highly relevant example is access to suspended or blocked accounts . If an account that was disabled or under review manages to authenticate successfully, it raises a red flag for administrators, as it could indicate a serious security breach.

In addition, many platforms monitor activity after login . For example, if your email starts sending a lot of messages in a short period or if critical changes are made (such as modifying recovery data or saved passwords), they may consider this anomalous activity and block sensitive actions to prevent further damage.

When an alert might be a false alarm (but it should still be checked)

Although seeing an alert like this is scary, often the most innocent explanation has to do with legitimate changes in the way you use your accounts, without there being a real attack behind it.

A very common reason is having logged in from a new device that you have never used with that account: a newly purchased mobile phone, a borrowed computer, a tablet that you have just set up… For the system, that is equivalent to “another person” having logged in from a different device.

Another cause is connecting from a different location than usual. If you're traveling, working in another city, or connecting from a hotel, airport, or coffee shop network, the platform sees a new IP address and geolocation. Even within the same country, a change of city can trigger an alert.

Using a VPN can also trigger these warnings . By routing your connection through another country or region, the IP address the service sees is no longer your usual one; to the fraud detection system, it appears as if you're connecting from another part of the world, even if you're at home on the couch.

In all these cases, if upon reviewing the alert details (approximate city, device type, time) you recognize that it matches something you've done recently, there's no need to worry . You can simply confirm it was you or ignore the notification, although it's always a good idea to secure your account with extra measures like two-step authentication.

When does an alert indicate a real security risk?

The problem arises when the alert doesn't match any of your actions. If you receive a suspicious access notification and you haven't logged in recently from that location, device, or time , it's time to take action: someone might be trying to access (or may have already accessed) your account.

In many cases, attackers have obtained your credentials through data breaches and credential stuffing attacks . When a website suffers a breach and emails and passwords are leaked, cybercriminals often try those same combinations on other services (email, social media, banking, etc.). If you reuse the same password on multiple sites, you make their job much easier.

Another very common method is phishing . You receive an email or message that perfectly mimics the appearance of Google, Microsoft, Facebook, your bank, etc., and asks you to log in because there has been a security breach. If you click and enter your username and password on that fake page, the attackers steal your login credentials without you even realizing it.

There are also malware threats specifically designed to steal passwords , such as Trojans with keyloggers that record everything you type, including your passwords and usernames, or programs that extract passwords saved in your browser. If your device is infected, cybercriminals can collect all your login credentials and try them en masse.

Another more advanced technique is the theft of access tokens . When you log in to an app like Facebook or Instagram, a "token" is generated so you don't have to type your password every time. If an attacker obtains this token (through a vulnerability in the service, malicious browser extensions, etc.), they can access your account even without knowing your password.

Finally, it could be something as simple as logging into someone else's device and not logging out : a public computer, someone else's mobile phone, or a device you later sold or gave away. The person who physically has that device could easily access your accounts.

Beware: there are also fake alerts created by cybercriminals

Not all "unusual login" notifications actually come from Google, Microsoft, or the legitimate platform. Many attackers use emails and messages that mimic these alerts to lure you to phishing websites and steal your credentials.

These messages often mimic the style of official notifications: they include text such as "we have prevented a suspicious login attempt to your account ," logos that closely resemble the real ones, and even email addresses that, at first glance, appear authentic. The difference lies in small details: slightly altered domains, spelling mistakes, links that don't lead to the official domain, etc.

A common pattern is that this message urgently asks you to log in to verify your identity or prevent your account from being blocked, and offers a button or direct link. If you click it and enter your username and password, you'll be handing your data over to the attackers.

Therefore, whenever you receive a notification of suspicious activity, be wary of any requests for personal data, passwords, or codes that arrive via email or SMS. Legitimate companies will never ask you to send your password or enter it on a website other than their official one.

If you suspect that an email of this type is fake, you can open your browser and manually access the official website or app (for example, by typing the Google or Microsoft address in the bar, without using the link in the email) to check from there if there are actually security warnings.

How to check if the suspicious login was yours

The first thing to do when you receive an alert is to confirm the legitimacy of the access . This involves reviewing both the account's recent activity and the actions you have taken in the last few hours or days.

If you use a personal Google account, you can go to your Google Account and check the security section . In the side menu, go to "Security" and look for the "Recent security-related activity" or "Your devices" panel. There you'll see recent logins, with details such as the device type, approximate location, and time.

Google lets you click on each activity to see more login details . If you spot unfamiliar locations or devices, it's a clear sign that someone else has accessed or attempted to access your account. In that case, from the same panel, you can click on "Protect your account" and follow the wizard to change your password and strengthen your security.

Microsoft offers something very similar through your account's Recent Activity page . From there, you can confirm whether or not it was you at each login. Furthermore, if you indicate that an access is not yours, Microsoft can block suspicious sessions and assist you with the recovery process.

On social media platforms like Facebook or Instagram, the security settings menu usually includes options such as "Where you're logged in" or "Active sessions." In that list, you should check devices, locations, and dates. If you don't see anything unusual, the alert was probably a false alarm or simply a notification about a new device.

Once you review these logs and confirm that all sessions belong to you, you can mark the activity as safe in the alert itself (by pressing "Yes, it was me", or similar) and continue using your account normally, although it is always recommended to activate advanced measures such as two-step verification.

What to do if the activity is NOT yours: immediate steps

The moment you verify that you didn't access your account, you must react quickly to minimize the damage . The priority is to remove the intruder from your account and cut off any possible way for them to regain access.

The most urgent thing to do is change the password for the affected account . Always do this from the official service website, logging in yourself and not through links sent to you by email. Choose a strong, long password that mixes uppercase and lowercase letters, numbers, and symbols, and that you haven't used anywhere else.

Next, it's a good idea to log out of all devices . Many services let you do this with a single click from the security settings (for example, on Facebook you can end all remote sessions, keeping only the current one). On others, like Instagram, you'll have to manually log out of each listed device.

Also check your account recovery information : phone number, alternate email address, and, in some cases, security questions. If an attacker has gained access, they may have changed this information to maintain long-term control. If you see anything suspicious, re-enter your correct information.

Finally, initiate a guided account protection process if the platform offers it (Google, Microsoft, and many social networks have security assistants that guide you through all the critical points: devices, login activity, application permissions, passwords, etc.).

What to do if you can no longer access your account

Sometimes, by the time you realize there has been suspicious activity, the attacker has already taken control (for example, changed the password and locked you out), or modified the recovery email so that you don't receive the codes.

If your Microsoft account has been locked or you've forgotten your current password, you can use the official sign-in help tool . There, you answer security questions, confirm your identity via email or SMS, and follow the steps provided by the platform to regain access.

On social media, almost all platforms offer some kind of compromised account form . They will ask you to provide a contact email address, screenshots (if you have them), or even an identity document in extreme cases, to verify that you are the legitimate owner.

If you still can't recover your account using the automated steps, it's best to contact the platform's technical support directly . In the help section, you'll find options like "I can't log in" or "My account has been hacked." There, you can explain the problem in detail.

In the case of critical email services (for example, the account associated with online banking or other sensitive services), it may also be worthwhile to consult with specialized cybersecurity services or official helplines, which will advise you on what to do if you suspect a serious account hijacking.

What to do when there is blackmail or deletion of information

Sometimes attackers aren't satisfied with just gaining access to your account; they proceed to extort you or damage your information . A typical example is receiving emails (often in another language, such as English) claiming they've accessed your account, deleted your messages, or downloaded your data, and demanding payment to recover it.

In these situations, cybersecurity experts' recommendations are very clear: never give in to blackmail . Paying guarantees absolutely nothing; it only fuels the criminals' business and, moreover, may encourage them to continue pressuring you with new threats.

If you suspect your computer or mobile device has been infected, it's essential to install an updated antivirus program and run a full scan . This will help detect Trojans, keyloggers, or other malware that may have facilitated the theft of credentials or is still active, stealing more data.

You should also review your installed applications and recent downloads , uninstalling anything you don't recognize or use, and keeping the rest up to date with the latest security updates.

If the strange behavior persists and you still suspect an infection, it may be a good idea to start in safe mode or restore the device to factory settings, after backing up any important files you want to keep (and also scanning that backup with a reliable antivirus).

Once your computer is clean, change all your important passwords again (email, social media, financial services, shopping platforms, etc.) using strong and different passwords for each site, and activate two-factor authentication whenever the service allows it.

How to minimize false alerts and improve security

It can be annoying to receive alerts every time you log in from a new phone or when you travel, but these notifications are one of your best defenses. Even so, there are ways to reduce false alarms without compromising security.

One of the recommendations from platforms like Google is to register your accounts for two-step verification . When a login is legitimate but from a new device, you can quickly confirm it with a code on your mobile phone or through an authenticator app, and the system will "learn" which devices are trusted.

In organizations that use Google Workspace or Microsoft 365, administrators can encourage (or even require) all users to have two-factor authentication enabled . This way, even if alerts are received about unusual access, the risk of someone actually gaining unauthorized access is greatly reduced.

In addition, getting into the habit of regularly checking your account activity (recent logins, connected devices, open sessions) will allow you to quickly detect unusual access, even if the platform has not yet issued any automatic alerts.

Finally, educating users (family, work team, etc.) on how to recognize official notices and how to distinguish them from phishing attempts will make everyone less exposed to fake notifications that seek to steal passwords.

Protect yourself from phishing attacks that mimic security alerts

Many emails that appear to be a "suspicious login" alert are actually very well-designed phishing attacks that seek the exact opposite of protecting you: to steal your login credentials.

To protect yourself, get into the habit of scrutinizing the actual sender of the message and learning about the most common cybersecurity mistakes . Sometimes only one letter of the domain name is different (for example, g00gle instead of google), or strange subdomains that don't belong to the legitimate company are used. If something seems off, don't click on any links.

Also check the message content: cybercriminals often use urgency and exaggerated threats like "if you don't click in the next 10 minutes, you'll lose your account forever." Official security alerts don't need this kind of drama.

When you receive a suspicious alert, the safest thing to do is open your browser and go directly to the official website , logging in normally, without using the link in the email. From the security panel, you can check if there are actually any warnings or suspicious activity.

If you confirm that a message is fraudulent, many email platforms like Gmail allow you to report it as phishing . Open the message, tap the options menu (the "More" icon), and select "Report phishing." This helps the system detect and block similar campaigns in the future.

Daily best practices to protect your accounts

Beyond reacting when an alert has already been triggered, it is key to incorporate certain habits that make your accounts much more resistant to attacks and minimize the impact if someone manages to steal a password.

The first step is to use strong, unique passwords for each service. No “123456,” birthdays, or pet names repeated everywhere. A password manager can generate complex passwords and save them for you so you don't have to remember them all.

Always enable two-step authentication (2FA) whenever possible . With this system, even if someone gets hold of your password, they will also need a temporary code sent to your mobile phone or generated by an authenticator app, making it much harder for them to gain access.

Keep your devices protected with reliable, up-to-date antivirus software , and regularly update your operating system and applications. Many password-stealing infections exploit known security vulnerabilities, which are precisely what these updates patch.

Finally, get into the habit of occasionally reviewing the apps connected to your account and the permissions granted to it (for example, third-party apps that access your Google, Microsoft, or social media accounts). If you see any you don't remember or no longer use, revoke their access.

Understanding the reasons behind suspicious login alerts, distinguishing a legitimate notification from a phishing attempt, reacting quickly to unfamiliar activity, and implementing measures such as strong passwords, two-factor authentication, and regular security reviews will make your online accounts much harder to compromise. This will also allow you to resolve the situation calmly and with minimal disruption if a serious alert ever arises.