Review Google account sessions without mistaking every entry for an attack
Compare device, time and your actual activity, then sign out unfamiliar sessions and inspect recovery settings.
In brief
A Google device list can show multiple sessions for one device or browser. Read the details and compare with your use; an approximate location or repeated entry alone is not conclusive evidence of compromise.
The review is still worthwhile when a sign-in or device genuinely does not match what you did.
Use several clues together
Compare device type, browser and the time of activity with your own sign-ins. A VPN, mobile network or travel can affect the displayed location. If the evidence is uncertain, sign out a nonessential old session as a precaution without declaring it an attacker.
Remove access deliberately
Use the session’s sign-out action and check other sessions for that device when required. If it is a device you sold or lost, remove the appropriate access and review stored account data. A device name can be familiar while its current ownership is not.
If the activity was not yours
Use a trusted device to change exposed credentials and inspect recovery information, MFA methods and third-party access. For Gmail, review forwarding and delegation when relevant. Keep the actual suspicious event detail, rather than relying on a screenshot of the device count.
Before you act
Removing a session does not explain the cause of an unauthorized sign-in. Password reuse, stolen session data and an unwanted third-party connection need their own checks.
What to do next
- Open Google Account → Security & sign-in → Your devices → Manage all devices.
- Inspect device/session details against your recent activity.
- Sign out entries you do not recognize and follow Google’s compromised-account checks if activity was unauthorized.
