Sign-in alert emails
The security emails the platform sends, what the new sign-in alert says, and what each choice on its page does.
On this page
The platform emails you when something happens on your account that you should know about. These are security alerts. They go to all of your verified addresses, you cannot turn them off, and they are separate from the optional email on the preferences page.
Two kinds of alert#
Account change alerts tell you that something about your account changed. The email has the subject Security alert: followed by what happened, shows the time, and says: if this was you, no action is needed; if it was not, review your account now. A Review your account button opens the right page of your account.
The changes that send one include:
- a password set or changed;
- a passkey added, renamed or removed;
- an authenticator app enabled or disabled, and recovery codes issued or regenerated;
- a change of primary email address, or the reverting of that change;
- an account recovery completed, or a pending recovery cancelled;
- another account merged into yours;
- an access token created or revoked, or every token revoked;
- device trust updated;
- a data export requested;
- your account deactivated at your request.
New sign-in alerts tell you that someone signed in from a device the account had not seen before. This is the one that needs a decision.
A third kind belongs to the lost-passkey fallback: A sign-in skipped your passkey goes to your other verified addresses when someone asks for the emailed code instead of using your passkey, and the sign-in that follows always sends the new sign-in alert. See What a security alert email means.
The new sign-in alert email#
The subject is New sign-in to your account. It lists:
| Field | What it shows |
|---|---|
| Device | The browser and system. |
| Country | The approximate country, or unknown. |
| Address | The network address. |
| Method | How the sign-in was proven. |
| Time | When it happened. |
It says that if this was you, no action is needed, and that if it was not, you can sign that session out or secure your account. The Review this sign-in button opens a page. The link works once and expires; the email states when.
Alert emails never ask for your password. If an email asks for it, do not follow it.
The emails and the pages they open are written in the language saved in your profile (English, plus French or Spanish where that language has been switched on). If your profile has no available language, the language of the sign-in that caused the email is used, and otherwise English. The wording quoted on this page is the English version. See Languages.
The page: Was this you?#
The page is titled Was this you? and says: We signed someone in from a device we had not seen before. It shows When, Approximate place and Browser. Opening the link changes nothing, so a mail program that previews links cannot trigger anything. Only a button does.
There are three choices:
| Choice | What it does |
|---|---|
| Yes, that was me | Takes you to your account. Nothing changes. |
| No, sign that session out | Ends the session that was started, and any other session that same browser opened since. Forgets that device, so its next sign-in counts as a new device and sends an alert again. Every other device you had marked trusted drops back to recognised. The page says That session was signed out. |
| No, secure my account | Ends every session and every access token, forgets every remembered device, and cancels any pending sign-in links and account recovery that someone else may have started. The page says Continue to secure your account. and offers Recover your account. |
After No, secure my account you also receive an email titled Your account was secured, saying every session, API token and remembered device was ended.
Neither choice changes your password. The platform does not claim that it did. If you think someone knows your password, change it from Security and passkeys after you sign in again. If you cannot sign in again, the follow-up is account recovery, which the page points you to.
A related page: Confirm this sign-in#
Some unfamiliar sign-ins are held until you confirm them. The page, titled Confirm this sign-in, says: We saw a sign-in from a browser or place we do not recognise. Confirm only if it was you, and only in the browser you were signing in with. The choices are Yes, this was me and No, this was not me. See Signing in.
How the platform decides that a sign-in is unfamiliar is not described here.
If a link does not work#
| What you see | What it means |
|---|---|
| This link is not valid any more. | It has already been used, it expired, or it was never valid. All of these give the same message. |
| No alert email arrived | It goes to your verified addresses only. Check your spam folder, and that the address on the account is verified. |