A message you do not remember sending or a warning about mailbox access deserves a measured check. Gmail's Last account activity lists recent access types, times and IP addresses. It can help you find an unfamiliar session, although mobile networks and mail apps can make locations look surprising.
Before you start
Use a computer you trust, open Gmail directly and note the suspicious message's time. If you already know a password was exposed, secure the account immediately rather than waiting for a perfect activity explanation.Do it step by step
- At the bottom-right of Gmail, open Details beside Last account activity. Confirm that you are inspecting the intended Google Account.
- Compare access times with your own phone, computer, browser and mail clients. Check whether POP or IMAP access belongs to a connected mail application.
- Record unfamiliar access types and approximate locations. A different city alone is weak evidence because carriers and VPNs can route traffic elsewhere.
- Open your Google Account's Recent security events and signed-in devices through its official settings. Check for password, recovery or device changes you did not make.
- If the activity remains unexplained, change the password from the trusted device, review recovery options and connected apps, enable strong verification, and report the incident if it is a work account.