Checking Gmail login activity is the fastest way to find out whether anyone else is in an account, and it is also the fastest way to frighten yourself over nothing. Most entries that look alarming are your own phone reported through a carrier gateway in another city. This guide is how to read the list properly: what the fields mean, which anomalies matter, and what to do on an account you have just taken over.
Where to look
There are two separate views and they answer different questions.
| View | Shows | Best for |
|---|---|---|
| Last account activity, at the foot of the Gmail web interface | Recent sessions with times, rough locations and access type | A quick check of who has been in the mailbox |
| Your devices, in the Google account security settings | Every device with a current or recent session | Signing things out, and spotting what you no longer own |
The first is the better diagnostic and the second is where you take action. Use them in that order.
Why the locations look wrong
This is the part that causes most unnecessary alarm. Locations are inferred from the network address, and that routinely misplaces people:
- Mobile data is often reported at a carrier gateway, which can be hundreds of miles away.
- Corporate networks exit through a head office, so a session at your desk may be reported in another country.
- A VPN reports wherever its endpoint is, including one you forgot was switched on.
- Mail clients appear as IMAP or POP rather than as a browser, and can look like an unfamiliar access type.
A surprising city on its own is weak evidence. A surprising city plus an access type you do not use, at a time you were asleep, is worth acting on.
Reading Gmail login activity for real problems
Three patterns are worth treating seriously:
- Sustained access from somewhere you have never been, repeated over days rather than one entry. Someone else is signing in.
- An access type you do not use. IMAP or POP sessions on an account you only ever open in a browser is the classic sign of mail being pulled quietly in the background.
- A device you do not recognise and cannot account for. Not an old phone of yours — something genuinely unfamiliar.
Against that, a single odd entry that matches a time you were using the account on mobile data is almost always the carrier, not an intruder.
Acting on Gmail login activity that looks wrong
The order matters here as much as anywhere, because signing out an intruder without closing their way back in simply delays them:
- Change the password. This ends most other sessions as a side effect.
- Check the recovery email and phone and remove anything you did not set. This is the step people skip and it is the one that matters — a recovery address someone else controls lets them back in whenever they like.
- Check filters and forwarding. A quiet forwarding rule is the most common thing left behind, and it survives a password change.
- Turn on two step verification with an authenticator app if it is not already on.
- Sign out all other sessions from the devices list, last rather than first.
Step three deserves emphasis. An intruder who has gone does not matter; a forwarding rule they left behind keeps sending your mail indefinitely.
On an account you have just bought
Here the session list is not a security check, it is part of the handover. An account that has been held as stock may have sessions on devices that were never yours, and the previous holder's recovery options may still be attached — which, since Google has no concept of the account changing hands, is a live route in rather than a historical curiosity.
So treat it as a checklist item: after your own recovery address is confirmed, the password is changed and your own two step verification is in place, review the devices and sign out everything you do not recognise. Doing it before those steps simply signs you out of nothing useful. The full order is in the security setup guide.
One caveat. If the account arrived with session cookies as part of a bulk order, signing out all sessions invalidates them, which may be the opposite of what you wanted on day one. Decide deliberately rather than clicking it by reflex.
Checking regularly without becoming paranoid
Once a month on an account that matters, and whenever you get a security alert, is plenty. What is more useful than frequent checking is making sure the alerts can reach you: a current recovery email, a second factor you control, and a phone number that is actually yours. Those turn an unnoticed intrusion into one you hear about the same day. If an alert ever asks you to confirm a sign-in you did not make, treat it as real and work through the list above — and see the verify it's you guide for the challenges that are not intrusions at all.
Frequently asked questions
Where do I see recent Gmail login activity?
At the bottom of the Gmail web interface there is a last account activity link showing recent sessions with times, rough locations and access types. The devices list in the Google account security settings is the companion view, and it is where you sign things out.
Why does it show a city I have never visited?
Because the location is inferred from the network address, and mobile data, corporate networks and VPNs all report at their exit point rather than where you physically are. On its own an unexpected city is not evidence of anything.
What counts as a genuine warning sign?
Repeated access from an unfamiliar place over several days, an access type such as IMAP that you never use, or a device you genuinely cannot account for. One odd entry matching your own mobile use is almost always the carrier.
Does signing out all sessions remove an intruder?
Only temporarily, if they can still get back in. Change the password and clear any recovery options and forwarding rules you did not set, then sign the sessions out, or they simply return.
Can I see login history from months ago?
Not in detail. The activity view covers recent sessions rather than a long archive, which is why acting on alerts when they arrive matters more than retrospective investigation.
Should I check a newly bought account's sessions?
Yes, as part of the handover rather than as a separate task, and after you have taken over the recovery path. Signing out unfamiliar devices before your own recovery address is confirmed achieves very little.
