Check account changes after suspicious activity
If you noticed odd logins, permission changes, or alerts you did not expect, check the account’s recent activity and the settings attackers usually touch first. Start with sign-ins, recovery details, sessions, and access rights before you change anything else. That gives you a clearer timeline and helps you separate a normal update from possible unauthorized access.
Start with the recent activity log
Before you start
- Access to the account, or access to the admin console if this is a work account
- Permission to view sign-in history, audit logs, or activity logs
- A way to save screenshots or export logs outside the account
- The approximate time you first noticed something strange
Steps
- Open the account’s recent activity, sign-in history, or audit log.
Most services show the time of each event, the device or browser used, the location, and the action taken. You are looking for a pattern, not just one odd entry.
- Review the events closest to the time you noticed the problem.
If the account shows labels like successful sign-in, password changed, role updated, or new device added, read those entries closely. A sign-in from a city you were in, on a phone you own, may be normal. A sign-in at 3 a.m. from a country you have never used is harder to explain.
- Check both the general activity log and the security-specific log, if the service has both.
The security log usually shows higher-value events such as sign-ins, recovery changes, MFA changes, and admin actions. The general log may show file changes, shared-folder edits, or app access. Together, they help you see what changed first and what changed afterward.
Check whether your password or recovery details were changed
Check the password, recovery email, recovery phone number, and any backup or recovery methods next. These are common takeover points because they let someone keep access even after you notice the problem.
Look for these kinds of changes:
- a password reset you do not remember approving
- a new recovery email address
- a new recovery phone number
- recovery codes regenerated
- backup email or alternate contact removed
- security questions changed, if the account still uses them
If the service shows a change history, confirm the time of each update. A password change followed by a recovery email change is a strong sign that someone tried to lock you out. A recovery update that matches an alert you received and approved may be normal.
If you can still access the account, review the current recovery options before you change them. If you remove the wrong backup method without recording what was there, you may lose part of the trail you need later.
Look for new devices, sessions, or trusted browsers
Check the list of active sessions, signed-in devices, and trusted browsers. This is where you can spot a laptop, phone, or browser that should not be there.
A useful example: if you see an office laptop you do not recognize, or a phone model you have never used, treat it as suspicious even if the login location looks close to yours. Attackers often use a new device and a familiar location, or a familiar device name that is misleading.
Review whether the session is still active or only listed in history. Active sessions matter most because they can still reach the account. Also check for trusted browsers or remembered devices, since those may stay valid longer than a normal sign-in.
If the account labels devices generically, compare the browser type, operating system, and last-used time. A browser you use every day is easier to explain than one that last appeared during the suspicious window and never again after that.
Review user rights, roles, and sharing settings
Check whether your access level changed, because attackers often try to make themselves an admin, add themselves to a group, or widen sharing permissions. If this is a work account, review your role, group membership, mailbox permissions, and any delegated access. If it is a personal account with shared access, check who else can view or manage it.
Look for changes such as:
- new admin or owner roles
- changed group membership
- new delegated access or shared mailbox rights
- sharing links set to broader access than before
- new collaborators added to files, folders, or projects
- permission changes on a team, workspace, or app integration
Compare the current rights with what you expect. A small permission change can be legitimate if you asked for it, but an access expansion you did not request is a warning sign. Pay special attention if the change lets someone forward mail, delete messages, approve sign-ins, or manage other users. Those are the kinds of changes that can hide more activity later.
Compare the change history with anything you did yourself
Match the changes you see against what you remember doing. Use the date, time, alert message, and the exact action to separate normal activity from something suspicious.
A clean way to compare is to ask yourself:
- Did I sign in from a new device at that time?
- Did I change my password, recovery email, or phone number?
- Did I approve an app, browser, or device prompt?
- Did I ask someone to change my role or share access with me?
- Did I make this change while traveling, using a VPN, or switching phones?
Some normal events can look odd at first. A system update, device migration, or browser refresh may create a new sign-in, a new trusted device, or a fresh session. Those are more likely to be normal if they line up with something you knowingly did and the account’s own alert matches that action.
A change is more suspicious when the timing does not fit your actions, the location is unfamiliar, the device is new, or the change sequence does not make sense. For example, if you see a password change and a role change but you only remember reading email, treat that as a likely compromise until proven otherwise.
Save proof before you change anything
Before you revoke access or edit settings, save the evidence. Once you make changes, you may lose the original trail that explains what happened.
Capture:
- screenshots of the activity log and security log
- timestamps for each suspicious event
- device names, browser names, and locations shown in the log
- the current password, recovery, role, and sharing settings as displayed
- any alert emails or texts tied to the events
- the order in which you found the changes
If the service lets you export logs, save a copy before editing the account. Keep the files somewhere separate from the account itself, such as a secure folder or device you trust. If you are working on a company account, send the evidence to IT or security in the format they ask for.
Do not rely on memory alone. Even a few screenshots with clear timestamps can help support staff see whether the account was changed once or repeatedly over a short period.
Remove anything you do not recognize and secure the account
Once you have a record of what changed, remove unknown access and harden the account.
- Sign out of all other sessions or devices that you do not recognize.
- Revoke access for unfamiliar browsers, apps, and connected devices.
- Change the password to a strong one you have not used before.
- Reset recovery email and phone details to values you control.
- Turn on stronger sign-in protection, such as multi-factor authentication, if the account supports it.
- Review forwarding rules, app access, and sharing settings again after the reset.
If the account offers a sign out everywhere or remove all devices option, use it when you suspect compromise. If you keep one known-good device signed in, make sure it is actually yours and that the session still looks normal after the reset.
After the cleanup, watch for new alerts or fresh logins. If someone already had access to the recovery methods, they may try again unless those details are replaced too.
What to do if account rights changed but you cannot reverse them
If you cannot undo the change, stop trying random fixes. The account may be managed by a company, school, reseller, or another owner, and local changes may be blocked on purpose.
Check whether the account says it is managed, delegated, or owned by an organization. If so, you may need admin help to restore roles, remove a device, or undo policy changes. For a personal account tied to someone else’s recovery details, you may need the provider’s recovery flow instead of the normal settings page.
If the account is locked down by software, a mobile device manager, or a company policy, gather the proof you saved and contact the person or team that controls it. Tell them exactly what changed and when. Ask them to review admin logs, device enrollment, mailbox rules, and any recent permission updates.
Do not create workarounds that bypass management controls. That can make recovery harder and may erase the trail you need to prove the account was altered without approval.
When to contact support or your IT team
Escalate right away if you see unknown admin changes, new mailbox forwarding rules, repeated failed logins, or a recovery method you do not control. Those signs usually mean the problem is broader than a single bad sign-in.
Contact support or IT sooner if:
- your password no longer works
- the recovery email or phone number has been replaced
- you see a new admin, owner, or delegate you did not add
- a mailbox rule is sending messages out or deleting them
- the account keeps showing fresh logins after you sign out other sessions
- you suspect a linked device or app is still active
When you contact them, send the evidence you recorded and say what you already changed. That saves time and lowers the chance of duplicate steps. If this is a work account, your IT team may also need to check related systems such as SSO, directory roles, email routing, or endpoint enrollment.
Quick checks people often miss
A few places are easy to overlook. App passwords, forwarding rules, API tokens, and connected apps can all reveal tampering even when the main password looks fine. If the service supports them, check whether new app access was granted or existing access was expanded.
Also look at:
- email forwarding and inbox rules
- OAuth or third-party app permissions
- recovery codes that were regenerated
- backup MFA methods, such as another phone or authenticator app
- API keys or access tokens for developer or business accounts
- shared folders, drives, or team spaces with new external access
If you find one of these changed and you did not do it, treat it like the password changed. Record it, remove it if you can, and check the rest of the account for related activity. Attackers often change one setting just to keep their access alive after the obvious signs are fixed.
Finish by confirming the account is back under your control
Completion
You should know which changes were yours and which ones were not. The activity log should line up with your own actions, unfamiliar sessions should be removed or flagged, and the current password, recovery details, devices, roles, and sharing settings should match what you expect.
If anything still looks off, keep the proof you saved and move straight to sign-out, credential reset, and support or IT escalation. The main goal is to understand the timeline before you close the door behind the intruder.
Conclusion
Once you have checked the logs, recovery details, devices, and permissions, you should know which changes were yours and which ones need action. If anything still looks off, keep the proof you saved and move straight to sign-out, credential reset, and support or IT escalation. The main goal is to understand the timeline before you close the door behind the intruder.
Frequently Asked Questions
Can normal system updates create suspicious-looking sign-ins?
Yes. Device migrations, browser updates, VPN use, and account sync can create new sessions or location changes. They are more likely to be normal if the time matches something you did and the account shows only the expected device or browser changes.
Should I change the password before I save screenshots?
No. Save the evidence first if you still can. Once you change the password or remove access, some logs and session details may be harder to interpret later.
Do forwarding rules matter even if my password was not changed?
Yes. Forwarding rules can send copies of messages to someone else without changing the password at all. They are a common place to check after suspicious activity.