Every so often, check logged-in devices and authorized apps on your accounts; remove what you no longer use

“Logged-in devices” means the phones and computers that can still use your account right now. If an unfamiliar device appears on the list, or software you stopped using still connects to your account, change the password first, then sign out everywhere. For email, also check whether any auto-forwarding was set without your knowledge.

Cost

No cost. A few minutes each time. The hard part is that nothing reminds you; you have to remember to look.

Benefit

The logged-in-devices list records which phones and computers can still use the account. The authorized-apps list records third-party apps you allowed to sign in with the account. Unfamiliar devices and long-unused third-party apps are the easiest traces to spot. The UK National Cyber Security Centre lists “logins or login attempts from unfamiliar places or at unusual times” as signs of account compromise. It also says criminals often add a forwarding rule in email so every message to you is copied to them, which they use to reset your passwords. Its recommended order is: remove unknown forwarding rules, change the password, then sign out all devices and apps. After sign-out, anyone else needs the new password to use the account. The US Federal Trade Commission likewise advises signing out all devices after regaining an account and deleting forwarding rules you did not set

Notes

WeChat, Alipay, email, Apple ID, and Android accounts all have this screen. If you see an unfamiliar device, change the password first, then choose sign out everywhere; that is the order the UK NCSC gives. Rated C because both sources are official how-to guides, with no study on how much periodic checks reduce losses.

Sources · 3

1. UK NCSC. Recovering a hacked account. ncsc.gov.uk/guidance/recovering-a-hacked-account
2. US FTC. How To Recover Your Hacked Email or Social Media Account. consumer.ftc.gov/articles/how-recover-your-ha…
3. 两份都是账号出事以后的处理指南，「隔一段时间主动去看」是作者经验