Got a new sign-in alert? A five-minute response plan
Most alerts are you on a new phone or network. When one is not, these steps lock things down quickly.
In this guide
A sign-in alert lands in your inbox: a new device, a new location, a new browser. Most of the time it is you, on a new phone, a hotel network, or a browser that cleared its cookies. Sometimes it is not. Either way, the useful response takes about five minutes and follows the same steps. Having the plan ready means you act calmly instead of guessing.
Minute 1: is the alert real?
Fake sign-in alerts are a common phishing trick. They link to a page that looks like the real sign-in and steals what you type. Before clicking anything:
- check the sender's address carefully, not just the display name;
- do not click links in the email; instead, open the site by typing its address or using your bookmark;
- sign in there and look at the account's security or activity page.
If the account shows no matching activity, the email itself was probably the attack. Delete it. Checking whether an email is real lists more signs.
Minute 2: was it you?
Compare the alert with what you did recently:
| Alert says | Likely you if… |
|---|---|
| New device | You signed in on a new phone, computer or browser |
| New location | You are traveling, or on mobile data, a VPN or public Wi-Fi |
| New browser | You cleared cookies, used a private window or updated the browser |
| Unusual time | You signed in late or early, or from another time zone |
Locations based on network addresses are approximate. A city a few hours away can still be you on mobile data. If everything matches, no action is needed. If anything does not, continue.
Minute 3: lock the door
- Change the password to a new, unique one. If you used the old password anywhere else, change it there too.
- Sign out other sessions if the site offers it. This kicks out anyone already signed in.
- Check two-factor settings. Make sure the authenticator is still yours and no new method was added.
If someone signed in successfully, they had your password and either a code or access to a session. The authenticator usually stops attackers who have only the password, which is why the alert might simply show a failed attempt.
Minute 4: refresh recovery
- Generate new recovery codes and store them safely. Old ones stop working.
- Check that the recovery email and any recovery phone number are yours.
- Review connected apps and API keys; remove any you do not recognize.
Minute 5: check money and ask for help
For a BuyVCC account:
- Open My Cards and check each card's balance and status.
- Check your orders for anything you did not place.
- If anything looks wrong, or if you think card details were revealed by someone else, open a support ticket immediately with the time of the alert and the card endings involved. We can look into card status and help secure the account.
Revealing card details on our site requires a fresh authenticator code, so a password alone does not expose them. That is the point of the design, and it is why protecting the authenticator matters so much.
If you cannot sign in
If the password was changed by someone else, use the site's password reset. If the authenticator was changed too, use a recovery code. If you have neither, contact support through the official site. For BuyVCC, a 2FA reset needs a support ticket and checks that confirm you own the account. It is slower than a recovery code on purpose.
After the urgent steps
- Find the leak. Did you reuse a password? Enter it on a suspicious page? Install a new extension? Share your screen with someone? Fix the cause, or it will happen again. Screen sharing risks and browser extensions cover two common ones.
- Check your email account. Email controls resets for everything else. Review its sign-in activity, forwarding rules and recovery details.
- Use a password manager so every account has a unique password.
- Keep alerts on. They are your early warning.
Practice when it is you
The next time an alert arrives because of your own new phone, use it as practice: open the site directly, look at the activity page, confirm it is you. The habit of never clicking alert links and always checking the activity page is what protects you when an alert is real or fake.
Card-related alerts from other services
If an ad platform, store or software company alerts you about a sign-in, follow the same plan on that service. If a card is saved there, check that service's payment and order pages, then check the card's balance in My Cards. A prepaid card limits what can be spent, but quick action stops even that. Spend caps and card balances shows how ad accounts can add another layer.
Quick answers
The alert shows a city I have never visited. Is that bad?
Not always. Network locations are approximate, especially on mobile data or a VPN. Check the activity page and act if anything else is unfamiliar.
Should I delete my account after an alert?
Usually not. Securing it is enough. Deleting can make recovery and refunds harder.
See how it works and pricing.
BuyVCC Team
The people who review BuyVCC orders write these guides from the questions customers send us. Notice something outdated? Let us know.