Verify the alert independently
A security notification can be useful, but a fake message can imitate it. Open the service’s official app or navigate to its known address to review recent activity. Avoid entering credentials through an unexpected message link.
Read the available context
Compare the time, device and activity with your own actions. Approximate locations can differ because of mobile networks or VPNs, so a location alone is not decisive. Focus on whether you recognize the sign-in and account changes shown by the provider.
Take action on unfamiliar access
Use the provider’s controls to end suspicious sessions. Review your password, recovery settings, second-factor methods and connected apps. If a password was exposed or reused, replace it with a unique one. Enable a stronger sign-in method where supported.
Understand what 2FA does not reveal
An alert does not necessarily mean an attacker bypassed 2FA. Some notices describe failed attempts; others involve existing sessions or another recovery route. Read the provider’s description rather than assuming how access occurred.
Keep useful records without sharing secrets
Record the timing and relevant account changes if you need to contact official support. Do not include current codes, secret keys or recovery codes. Continue checking recent activity after you secure the account.