The unfamiliar browser check
What it means when identity asks you to confirm a sign-in from a browser or place it does not recognise, what you will see, and what to do.
On this page
Most sign-ins are from a browser your account already knows. When one is not, identity looks harder at it. This page explains what that means for you, in terms of what you see and what to do. It does not describe how identity decides what is unfamiliar, because publishing that would help someone get around it.
What "unfamiliar" means#
A browser or place is unfamiliar when your account has not seen it before. Travelling, a new phone, clearing your cookies, a private window or a new browser are all ordinary reasons. Identity does not assume the worst. It asks you to confirm, which costs a person a few seconds and costs someone who only has your password a lot more.
Being asked is not an accusation, and it is not a sign that your account has been breached.
What can happen#
When a sign-in looks unfamiliar, one of these follows. Which one depends on your account and on the organization you sign in to.
| Outcome | What you see |
|---|---|
| Nothing visible | The sign-in goes through. If the browser is new to the account, you may get an email afterwards. |
| A stronger step | You are asked for a second factor, such as your passkey or authenticator code, even if you would not normally be. You can also choose Email me a code instead, or Continue with my password only (limited session): a correct password always signs you in, and the limited session cannot change how you sign in, create tokens, export or delete your data until you confirm it is you. It always sends the alert email. |
| An emailed confirmation | The sign-in stops and a message goes to your verified email address. |
| A refusal | The sign-in is not allowed, and the page says it cannot continue. This is kept for a sign-in the platform judges too risky, or one an organization or application requires more for than you can give. If you are locked out, use recovery. |
The emailed confirmation is available where it is offered.
The confirmation page#
The page is titled Confirm this sign-in. It says: We saw a sign-in from a browser or place we do not recognise. Confirm only if it was you, and only in the browser you were signing in with.
It then shows the details of the attempt under Sign-in details:
- When it happened.
- Approximate place, a rough location from the network address, not a street address.
- Browser, the name of the browser.
- Open the email and follow the link. Opening it changes nothing by itself.
- Check When, Approximate place and Browser against what you were doing.
- If it was you, in the browser you were signing in with, select Yes, this was me. The page says Thanks. Continuing your sign-in.
- If it was not you, select No, this was not me. The page says Understood. That sign-in was not allowed.
Two safeguards are built in. The link is tied to the browser that started the sign-in, so opening it on your phone cannot confirm a sign-in someone started on another computer. And fetching the link, as a mail scanner does, confirms nothing: only your selection does. The link or the code from the email works once and for 15 minutes. If it is no longer valid, the page says This link is not valid any more.
The "Was this you?" email#
Separately, if someone was signed in from a device your account had not seen before, identity can email you after the fact. The page it opens is titled Was this you? and says We signed someone in from a device we had not seen before. It offers three choices.
| Choice | What it does |
|---|---|
| Yes, that was me | Nothing changes. |
| No, sign that session out | The alerted session ends, and so does every session that browser opened since. The device is forgotten and your other devices drop from trusted to recognised. |
| No, secure my account | Every session and token ends, devices are forgotten, and you go on to secure the account. Pending recovery requests and outstanding sign-in links are cancelled. |
The link in this email works for 7 days. The page repeats We never ask for your password by email. Identity never does. If an email asks for your password, it is not from identity.
A sign-in with the lost-passkey emailed code (see Authentication methods) sends this email every time, even from a browser the account knows, because the code stands in for the passkey.
What to do#
- If it was you: confirm, and carry on. If you keep seeing the check on a browser you use often, trust it on the Trusted devices tab, so the account stops treating it as new. See Trusted devices.
- If it was not you: choose No, this was not me on the confirmation page, or No, sign that session out or No, secure my account on the alert, then change your password and review your sign-in methods. See Security and passkeys.
- If you did not get the email: check that the address on the account is the one you read. Messages are sent to your verified addresses only. See Notifications.
A related rule: new browsers cannot change how you sign in#
Where it applies, a password-only sign-in cannot add or change a sign-in method from a browser the account has not confirmed for at least 24 hours. A browser is confirmed by a sign-in that proved more than the password: a passkey or a second factor, or a link or code emailed to you. A browser that has only ever signed in with the password stays unconfirmed however long it is used, and each of those sign-ins sends the alert email. An account that has a passkey or an authenticator app is never held to the wait: such an action shows Confirm it is you and asks for the second factor, whatever the browser's age. The account area tells you so and says to use a browser the account already knows, or to sign in once with an emailed link or code. For a password-only account's first passkey or authenticator app the password must be that old as well. 24 hours is the default and the minimum: an operator can lengthen the wait, up to 30 days. See Trusted devices.