How do I know if someone is logged into my account?

To know if someone is logged into your account, open the account's security settings and read its list of active sessions and devices: each shows a device, a location and a last-active time, and any entry you don't recognize is a live intrusion you can end. Then check for quieter signs, such as new mail-forwarding rules, unfamiliar third-party apps or changed recovery details. One caution shapes all of it: a stolen session cookie can grant access with no password and no MFA prompt, so a silent account is not proof of a safe one. SpyCloud found 17.3 billion stolen session cookies circulating in 2024.

How do I know if someone is logged into my account?

Open the account's security page and read its active-sessions or devices list. Every major service keeps one, and it names each signed-in device, the rough location and when it was last active. Any session you can't place is the answer to the question, and you can end it on the spot. This matters because stolen credentials were the single top initial-access vector in 22% of breaches (Verizon 2025 DBIR).

The sessions list is the strongest signal, but it isn't the only one. Intrusions also leave secondary marks: a sign-in from a country you've never visited, a device model you don't own, mail that's been read or deleted, or a security email you never triggered. Treat the visible indicators below as a checklist, then confirm each one against the service's own session log.

• Unknown devices or browsers in your account's device list.
• Sessions from a city or country you haven't logged in from.
• A new active session you didn't start, still showing as live.
• Mail-forwarding rules or inbox rules you never created.
• Unfamiliar connected or third-party (OAuth) apps with access.
• Changed recovery email, phone or MFA method you didn't set.
• Activity, sent mail or posts that don't appear in your own history.

Where do I view active sessions and devices on each service?

Mandiant put the global median attacker dwell time at 11 days, so unnoticed access is common (Mandiant). Every major platform exposes a signed-in-devices page, usually two or three clicks inside security settings. Below is the exact path for the five accounts attackers target most. Each list lets you end a session you don't recognize, which immediately logs that device out.

Google

Go to your Google Account, open Security, then in the Your devices panel select Manage all devices. Google lists every device signed in now or recently; pick any you don't recognize and choose Sign out (Google Account Help).

Microsoft

Check the Recent activity page for each sign-in's date, location and type, then use Sign out everywhere on the Advanced security options page to end sessions on all devices within 24 hours (Microsoft Support).

Facebook and Instagram

Both live under Accounts Center then Password and security then Where you're logged in. The list shows each device and location with access, and you can log out of anything unfamiliar (Facebook Help, Instagram Help).

GitHub

Under Settings, open Sessions in the Access section to see active Web sessions and Revoke session on any you don't own. For a fuller picture, Security log lists every action on your account for the last 90 days (GitHub Docs).

Per-service deep-dives will follow, walking each of these platforms screen by screen. For now, the pattern holds everywhere: find the session list, read it, and revoke what you don't recognize.

If there was no login alert, does that mean I'm safe?

No. A missing alert is not proof of safety, because the most common quiet intrusion produces no new sign-in at all. When an attacker replays a stolen session cookie, they reuse a session you already authenticated, so no fresh login event fires and no MFA prompt appears. SpyCloud found 17.3 billion stolen session cookies circulating in 2024, letting attackers impersonate users without credentials, MFA or passkeys (SpyCloud).

This is why the sessions list beats the alert inbox. An alert depends on the service treating the access as new and unusual; a replayed cookie looks like your own continuing session. The active-sessions page, by contrast, shows the raw truth of what's connected right now, whether or not anyone was warned. Isn't the connection you can see more useful than the alert you never got?

It also explains why a password reset alone can fail. Rotating the password invalidates a secret the intruder may not be using. The stolen session token is a separate credential with its own lifetime, and it stays valid until it expires or you explicitly revoke it. Containment means ending the live sessions, not just changing the password.

What are the quiet signs of intrusion beyond a strange login?

The persistence tricks. Once an attacker is in, the goal shifts from logging in to staying in, and those changes are subtler than a foreign sign-in. CISA has observed threat actors set up email-forwarding rules to quietly siphon a mailbox, searching messages for finance keywords and forwarding hits to their own accounts (CISA AR21-013a). Check your mail rules whenever a login looks off.

• Mail-forwarding rules that copy your inbox to an outside address you don't own.
• Inbox rules that auto-delete or file security alerts so you never see them.
• Third-party OAuth apps you didn't authorize, still holding access to mail and files.
• A recovery email, phone number or MFA app that has changed without your action.
• Sent messages, password-reset emails or posts that are missing from your history.

OAuth consent is the one most people miss. An attacker can get a compromised account to grant a malicious app, and that app keeps its access even after you change the password. Microsoft warns that once consent is granted, the app has persistent access to resources like mailboxes and files, and revoking it takes explicit action (Microsoft Learn). Review connected apps as part of every check.

What should I do if I see a session I don't recognize?

Cut the session first, then close the doors it may have opened. Ending the unknown session logs that device out, but an attacker with dwell time has usually planted persistence, and median dwell time is 11 days (Mandiant M-Trends 2025). Work the list below in order so a reset doesn't leave a live token or a hidden rule behind.

• Revoke the unrecognized session and use the service's sign-out-everywhere option to kill all live sessions at once.
• Change the password only after sessions are revoked, so the old token can't outlive the reset.
• Re-enroll MFA and check that the recovery email, phone and second factor are all yours.
• Delete any forwarding or inbox rules and remove OAuth apps you don't recognize (see MITRE ATT&CK T1114.003 for the forwarding technique).
• Review the account's security log or recent activity for what the intruder touched while they had access.

For an organization, one account is rarely the whole story. If credentials leaked from an infostealer infection, the same person's saved logins, cookies and tokens for other corporate systems leaked in the same sweep, and none of that shows in a single account's session list. This is the exposure Ashetrace is built to surface: you verify a domain you control and get a scoped view of which identities are already exposed, without handing over any passwords, cookies or tokens.

So the practical answer stays simple. Read the sessions list to see who's connected, don't trust the silence of a missing alert, and check the forwarding rules, connected apps and recovery settings that let an intruder linger after you think they're gone.