A sign-in approval you did not request

Ask one question before reading the location

A phone lights up on the kitchen counter with a clear system message asking if you are trying to sign in. At that exact second, you have not opened any browser, typed a username, or touched a login page. The city listed underneath looks remarkably close to home, and the device brand sounds vaguely familiar. Neither of these details creates a valid reason to tap yes. The single most powerful piece of evidence in your possession is the fact that you did not start the session. Deny the request immediately using the explicit negative response built into the genuine system prompt.

If the supposed approval arrives as a link in an unexpected text or email, do not use that link to investigate. A message can imitate the appearance of a security alert without being the provider's approval interface. Open the account's security page independently through your usual app or known address. This separates the decision about an actual prompt from a second possible problem: a message trying to send you to a false account page.

1. Confirm whether you just started the sign-in or account action shown in the prompt.
2. Do not approve an unrequested sign-in based only on a familiar location or device label.
3. Select the explicit negative response, such as No or Do Not Allow.
4. Open your account security dashboard independently if you wish to investigate further.

Do not lend approval to an unidentified session

A family member might call from another room asking whether you received a notification. If you cannot match it to a specific action, deny it first. Then discuss which account they selected and whether they should be signing in to it at all. If the account owner deliberately chooses to proceed, start a fresh attempt together on the intended device. You do not need to approve the earlier ambiguous request just because someone nearby has a plausible explanation.

Do not approve a request just to silence repeated notifications. A caller may claim that tapping a number or approving access will stop fraud, but the action displayed by the genuine service is what matters. Prompts can be associated with sign-in or recovery, so read the actual request rather than accepting the caller's description. End an unsolicited support conversation and inspect the account independently; do not lend an approval or code to an action you did not choose.

1. Deny a request you cannot match to a deliberate account action.
2. Check the selected account with a household member before starting again.
3. Do not follow an unsolicited caller's instructions to approve or share codes.
4. Start a fresh, understood attempt only when appropriate.

Check activity where the account lives

After denying the unexpected request, open the real account security page from a trusted device. Review recent events and the devices or sessions with access. Google explains that a single physical device can have multiple sessions, so a longer list is not by itself evidence of several intruders. Compare the account, device and timing with your actual activity, and use the provider's guidance for entries you still cannot explain.

Location labels can be approximate, and recent activity may include background communication. Do not declare an incident solely because a city name differs from yours, or dismiss one solely because the city looks familiar. Write down the entry you cannot explain and follow the service's review steps. If a family member helps, keep passwords and recovery codes private; they can help interpret the sequence without taking ownership of the account.

1. Open the official security page independently.
2. Review events and sessions alongside your actual activity.
3. Treat approximate locations and multiple sessions as clues rather than conclusions.
4. Follow the provider's instructions for access you cannot recognize.

When a family member chose the wrong account

Consider a family member setting up a new computer. In a hypothetical example, the browser remembers your Google Account, and they select it instead of their own. Depending on the sign-in flow, that attempt may produce a prompt on your phone. Being connected to the same Wi-Fi is not what triggers approval; attempting an account action is the relevant event. The person downstairs may have made an innocent mistake, but you cannot establish that from the notification alone.

In this hypothetical case, you look at the prompt, realize you are not trying to log in anywhere, and tap No. The family member downstairs stares at a failed login message, looks puzzled, and eventually realizes they selected the wrong profile icon. They correct their input, select their own credentials, and complete their sign-in without incident. Your prompt policy successfully handled an innocent household mistake without requiring you to lower your security standards or guess at intentions.

1. Recognize that a mistaken sign-in or recovery attempt can cause a prompt; sharing Wi-Fi alone does not.
2. Apply the standard rule of denying the prompt because you did not initiate the action.
3. Allow the other person to encounter a failed login and re-evaluate their input steps.
4. Verify that they intended to use an alternate profile or account.

When nobody recognizes the attempt

Consider a second example. An unfamiliar prompt arrives late at night while you are not signing in, and nobody you ask recognizes it. The correct description is an unrecognized attempt. A distant location or unfamiliar device does not reveal exactly who initiated it, how they got there, or whether your password was exposed. Refuse the prompt and investigate through the official account page rather than constructing a confident explanation from a few labels.

Denying the prompt refuses that request. It does not prove that the entire account is free of other active sessions or earlier unauthorized changes. Review recent activity promptly from a trusted device, check your recovery methods, and follow the provider’s instructions if the attempt was not yours. If you discover access you did not authorize, secure the account now rather than waiting for another notification or assuming that one denied request settled everything.

1. Deny a request you did not initiate.
2. Review account activity through the official service.
3. Check recovery methods and unfamiliar sessions.
4. Follow the compromised-account process promptly if evidence indicates unauthorized access.

Repairing access after an unrecognized prompt

If you ever encounter a situation where you accidentally approved an unknown request, or if security logs confirm that an unauthorized session gained entry, you must act swiftly using official recovery protocols. According to Google Account Help guidance on securing a compromised account, you should immediately change your password from a trusted device. Review unfamiliar applications and sessions, and follow the provider’s steps to remove unauthorized access.

Review recovery phone numbers, recovery email and extra sign-in methods as well as the main password. An unexpected change may matter even after you regain access. If the password was reused elsewhere, change those other accounts separately. Keep the review focused on evidence and the provider's current instructions; an unusual prompt is a reason to check, not proof that every account or device in the household has been compromised.

1. Access Google's official compromised-account recovery process promptly if intrusion occurred.
2. Change the account password from a trusted device.
3. Revoke access for any unrecognized devices, apps, or active sessions.
4. Audit recovery methods and update reused passwords on other unrelated services.

Frequently asked questions

Putting it into practice

A prompt is a request for a decision, not a task to clear from the screen. Deny the action you did not start, check the account through an independent route and use the official recovery process if access was approved or compromised. If the cause was a household mistake, begin again deliberately. The same habit handles uncertainty without requiring you to guess who was behind a notification.