Verified October 2026 against PlayStation, Xbox and Microsoft support pages.
An unexpected sign-in or account-change email usually means one of three things: you signed in somewhere new and forgot, a real change happened on your account that you did not make, or the message is a fake designed to get you to click. You can tell which by ignoring the links in the email and checking your account directly, through a browser tab you open yourself. What you do next depends on whether the notice is about a new sign-in or about a change such as a new password.
What these notifications are for
Account security emails let you hear about activity quickly, even away from your console. A notice alone does not prove someone else is in your account, and no notice does not prove nobody is.
Microsoft says that when it notices a sign-in attempt from a new location or device, it may send an email or text message to the alternate contact methods on the account. For PlayStation, Sony's help pages clearly describe emails sent when your sign-in ID (email address) changes: a confirmation goes to the old address, and a verification email goes to the new one. Either way, treat an unexpected notice as a reason to check, not to panic.
New-device notice versus password or account change notice
These two kinds of email look similar, but they tell you different things.
A new sign-in or new-device notice
This type reports that someone signed in, or tried to, from a device or location the account had not seen before. Harmless causes include a new phone or browser, a console you just set up, or a trip. Microsoft also notes that mobile networks can route your connection through other places, so a sign-in can appear to come from somewhere you aren't. If you can match the time and device to something you did, there is usually nothing else to do. If you cannot, assume someone may know your password.
A password, sign-in ID or security info change notice
This type reports that something on the account has already been changed. It is more serious, because a change you did not make means someone may have had enough access to alter your details, and a sign-in ID change on PlayStation signs the account out of all devices. Sony's guidance is to contact PlayStation Support through its Online Assistant if you see changes you don't recognize to your sign-in ID, online ID or password.
- New-device notice, not you: the password may be known to someone else, but you probably still control the account. Change the password and sign out other sessions promptly.
- Change notice, not you: you may already be locked out. Move straight to the official recovery route for your platform.
- Either notice, and it was you: no action is needed beyond noting it.
How to check a notification is genuine without clicking
Fake security alerts copy the look of real ones. The safest habit is to never use the links, buttons or phone numbers inside the message. Instead, type the address of the official site yourself or use a bookmark you already trust, sign in there, and see whether the account shows the activity the email described.
- For a Microsoft account (the one you use for Xbox): don't rely on the sender line alone. Sign in at account.microsoft.com yourself and open the Recent activity page; our guide to reading Microsoft account Recent activity explains what each entry means (Microsoft's own page is What is the Recent activity page?). Microsoft says its genuine security alerts come from [email protected], but a familiar sender line is not proof on its own.
- For a PlayStation account: The Sony help pages we checked don't list official sender addresses, so don't rely on the From line. Sign in to Account Management yourself and look at the Security settings: is the sign-in ID still your email address, and is 2-step verification set up the way you left it? We did not find a sign-in history page like Microsoft's described in Sony's help.
- The strongest red flag: any request for your password, a verification code or card details. PlayStation's security advice is never to share your account details with anyone, Microsoft's phishing guidance is never to click links in suspicious emails, and you should never share a verification code with anyone who contacts you.
If the account looks normal and nothing matches the email, it was most likely phishing. Our guide to spotting PlayStation and Xbox phishing emails covers the full list of red flags and how to report them.
When a real notice means someone else is using the account
If a sign-in or change was not yours, remove the other person's access and make sure they cannot get back in. On PlayStation, your sign-in ID is your email address, and Sony's advice for an account-change email you did not trigger is to change your email account's password first. On Xbox, Microsoft sends codes to the security info on the account (an alternate email or phone), so make sure those contacts are still yours.
The details differ by platform. On PlayStation, the key steps are changing your password, signing out of all devices and deactivating consoles; our page on what to do when someone else is using your PSN account walks through the signs and the order of steps. On Xbox, check Recent activity (see the guide linked above) and the account's Devices list, which shows the consoles linked to the account; see removing an unknown console from your Xbox account for that process.
If you can no longer sign in at all, use only the official routes: PlayStation Support's Online Assistant, or Microsoft's Sign-in Helper and then its account recovery form. One limit to know: if two-step verification is on and you can't reach any of your verification methods, Microsoft says it cannot help, so the form is not a way around two-step verification. Anyone offering recovery for a fee is not an official channel.
What to do next
- Don't click anything in the email. Open the official site yourself.
- Sign in and compare what you see with what the notice described.
- If it was you, you're done. If it wasn't, change your password and sign out other sessions now.
- If a password or sign-in ID change was not yours, go straight to official support or recovery.
- Add or review 2-step verification, and keep your backup codes somewhere safe.
To review everything in one pass, see Sony's security settings help page.