Skip to content
TDACorpIDENTITY
Latest
Sign in

The sign-in alert email

The email that tells you about a sign-in from a device your account had not seen, and what each answer on the Was this you page does.

On this page

When someone signs in to your account from a device it had not seen before, the platform can send an email to your verified addresses. It does not stop that sign-in. It tells you after the fact, so that if it was not you, you can act. The email is also always sent after a sign-in that used the emailed code for a lost passkey (see The second step), even from a browser the account has seen before, and after a sign-in where you chose Continue with my password only (limited session), which is also always followed by this email. While the operator has a test period switched on, this one email is paused; no other security email is. For how security emails are controlled, see Notifications.

The email#

This email is written in the language saved on your profile, otherwise in the language the application you were signing in to asked for, otherwise English. The English wording is quoted here; see Languages. The subject is New sign-in to your account. It lists:

LineMeaning
DeviceThe browser and system the sign-in came from.
CountryThe country the sign-in appeared to come from, or unknown.
AddressThe network address of the sign-in.
MethodHow the person signed in, for example with a passkey or a password.
TimeWhen it happened.

The email says If this was you, no action is needed. and, if it was not, to sign that session out or secure your account. Its button, Review this sign-in, opens the page below. The link works once and the email states when it expires.

A sign-in that finished with Email me a code instead (the lost-passkey fallback, see The second step) always sends this email, even from a device the account has seen. Your other verified addresses also get a separate message titled A sign-in skipped your passkey, with a Secure my account button.

The email never asks for your password, and neither does the page it leads to: We never ask for your password by email.

The Was this you page#

The page is titled Was this you? and says We signed someone in from a device we had not seen before. It repeats When and Browser, and the Approximate place when it is known. Opening the link changes nothing: the page only acts when you press a button, so a mail scanner that opens the link cannot do anything on your behalf.

It offers three answers:

ButtonWhat it does
Yes, that was meTakes you to your account. Nothing is changed. If you are signed out, the account asks you to sign in first.
No, sign that session outEnds that session, and the other sessions that same browser opened since. The page says That session was signed out. The browser is treated as new the next time it signs in. Your other devices are no longer treated as trusted.
No, secure my accountEnds every session and every access token, and forgets every device. Outstanding sign-in links stop working, and a recovery that someone started is cancelled. The page says Continue to secure your account. and offers Recover your account.

If the link has expired or was used already, the page says This link is not valid any more.

The Was this you screen opened from the sign-in alert email: when the sign-in happened and which browser, then three answers: Yes, that was me; No, sign that session out; and No, secure my account.
  1. Yes, that was me.
  2. No, sign that session out.
  3. No, secure my account.
Was this you? The page opened from the alert email. Nothing changes until you press a button. Sample data./sign-in

After you choose to secure the account#

You also receive an email titled Your account was secured. It says that every session, API token and remembered device was ended. It does not claim your password changed, because neither choice changes it. The email then tells you what to do next: sign in again and change your password from the security page. It also offers Start recovery, if you want to set a new password without signing in.

Whether a waiting period applies to that recovery is described on The recovery waiting period.

What to do if it was not you#

  1. Select No, secure my account, and not only the session option, if you think someone has your password.
  2. Change your password and add a second factor in your account. See Security and passkeys.
  3. Check Sessions and devices for anything you do not recognise.

Related#

Verified against commit c5ef357