Your phone asks you to approve a Google sign-in, but you are not signing in anywhere. Pause before tapping. The safest next step depends on whether you received an approval prompt, an activity alert, or just a text message containing a code.
The immediate rule: Never approve an attempt you did not start, and never give a verification code to someone who contacts you. Repeated requests do not make an unexpected request legitimate.
1. Identify the type of message
A “Trying to sign in?” prompt asks you to confirm an attempt. If it was not yours, choose No. Google gives this instruction in its Google prompts guidance. Do not match a number supplied by an unexpected caller or approve a request just to stop the notifications.
A “Did you just sign in?” alert reports account activity. Review the device and time. If the activity is unfamiliar, select No, it’s not me and follow Google’s account-protection steps, including changing your password. See Google’s unfamiliar-activity guidance.
An unexpected SMS code is different. Google says you can disregard and delete an unrequested code, and must not share it. A code arriving by itself does not establish that someone successfully accessed your account. See why Google sends texts.
2. Check the account independently
If the message arrived by email or text, avoid using its links to investigate. Open the Google app or type myaccount.google.com into your browser yourself. Confirm that you are checking the account named in the alert, especially if you have several accounts.
Review the security section for recent activity and signed-in devices. If you suspect another person has access, change the password from a trusted device and remove unfamiliar sessions. Also check recovery details, sign-in methods, and connected apps for changes you did not make. Google’s suspicious-activity checklist explains these checks.
For Gmail, that checklist also covers forwarding, filters, and delegated access. Those settings matter because an intruder’s changes may persist beyond the original sign-in.
3. If you already approved or shared a code
Treat the account as potentially exposed and begin the checks above promptly. Do not assume that rejecting the next prompt reverses an earlier approval. Replace a reused password on other affected accounts with unique passwords as well.
If you cannot sign in, use the recovery route linked from Google’s unfamiliar-activity guidance. For a work or school account, contact your administrator through a known channel. Never send a helper your password, backup codes, or a screenshot containing a fresh verification code.
Our compromise-response guide helps you choose the right next contact if more than one service is involved.
4. Strengthen the next sign-in
Keep two-step verification enabled while resolving the issue. Once access is secure, review your Google account recovery details and consider our Google passkey setup guide.
Make a habit of approving only sign-ins you initiated and recognise. An unexpected prompt is a reason to check, not a request you owe anyone permission to complete.
Was this helpful?
Help us make our guides more useful.
No sign-in needed. This browser remembers your response for up to 180 days.