Open the intended account first
If you have several work and personal accounts, it is easy to inspect the wrong one. Identify the address named in the alert, then use the familiar app or type the provider's known address yourself. Where possible, do this on a device whose condition you trust. You do not need the button inside the warning message.
A managed work account may have different logs and reporting procedures from a personal account with the same provider. Follow your organisation's process. If you can no longer sign in, use the official recovery route or your established IT contact rather than calling an unfamiliar support number found in an advertisement.
Compare time, outcome and device
Do not judge the event only by the city shown. Mobile networks, VPNs and IP-address location estimates can change the apparent location. Compare the time, device or browser and especially the recorded outcome. A rejected attempt is different from a successful sign-in you cannot explain.
Consider whether you recently configured an app or a new device, without using that possibility to dismiss an unexplained event automatically. Record which activity you recognise and which remains uncertain. Screenshots can help document the issue, but avoid exposing unnecessary account or location information when sharing them.
Act on an unexplained successful sign-in
Use the genuine provider's security controls to report suspicious activity and carry out its recommended account-securing steps. These may include choosing a new unique password, ending other sessions and checking recovery details. The appropriate sequence depends on the account type and the controls available to you.
Also review sign-in methods, connected applications and, for email accounts, forwarding rules. An unauthorised app permission can remain relevant after a password change. Do not remove every unfamiliar managed entry indiscriminately; ask the responsible administrator to investigate access you cannot identify.
Never approve an unexpected multifactor request simply to stop the notifications. If you have not started a sign-in, there is no corresponding request for you to approve. Report repeated prompts with their times so they can be compared with account activity.
Verify the account after securing it
Check that your own recovery methods remain accessible and that you can complete the next normal sign-in. Store newly issued recovery codes in a suitable separate place. Do not depend entirely on the device you are currently investigating to provide your only recovery route.
Review the activity again after making changes and note when each action was taken. For a work account, this timeline helps the person handling the investigation. Deleting the warning does not resolve the underlying event; the useful outcome is understanding the actual account state and correcting it where necessary.
