To check Gmail account access, review signed-in devices and connected apps in your Google Account, then check Gmail delegates and mail-routing settings. Signing out one device does not itself remove those separately configured routes. Google’s Security Checkup guide covers devices, third-party app access and recovery information; OKDIARIO also reports checks for Gmail delegates, filters, forwarding and POP/IMAP settings.
The access routes to check
| Access route | What to review | What the action changes or what to know |
| Device sessions | Your devices in your Google Account | Signing out ends that session. A listed contact time can reflect background syncing. |
| Third-party apps | Apps connected to your Google Account, including services using Sign in with Google | Removing the connection stops automatic Google sign-in, but does not erase data already stored by the app. |
| Gmail delegates | Delegation settings in Gmail on a computer | A delegate can read, send and delete email. A personal @gmail.com account can have up to 10 delegates, according to OKDIARIO. |
| Filters and mail routing | Filters with “Forward to” rules, forwarding, and POP/IMAP settings | These are separate Gmail controls; check each for unfamiliar rules or destinations. |
| Recovery information | Recovery phone and email | A recovery-phone change may take up to 7 days to take effect; the previous recovery information may still receive codes during that period. |
1. Review signed-in devices
Open your Google Account’s security area and inspect Your devices. Sign out of sessions for devices that are lost, sold or unfamiliar. OKDIARIO notes that sessions with the same device name can represent one device or more than one, and the listed contact time may reflect Gmail or Calendar syncing in the background.
The Gmail desktop Details activity panel offers another clue. OKDIARIO reports that it lists the 10 most recent IP addresses and approximate locations, with up to 3 additional addresses when Google flags suspicious activity. An IP address or approximate location does not identify the person who used the account; carrier routing or a POP/IMAP mail client can also affect the apparent location.
2. Review third-party app access
Check which apps and services have access to your Google Account, including services where you use Sign in with Google. Remove connections you no longer want. OKDIARIO reports that this stops automatic Google sign-in but does not delete information the app has already stored.
3. Check Gmail delegates
Review Gmail delegation on a computer. A delegate can read, send and delete messages; OKDIARIO reports that personal @gmail.com accounts can have up to 10 delegates. The Gmail mobile app does not provide delegation management, according to the outlet.
4. Inspect filters for forwarding rules
Look through Gmail filters for rules labeled “Forward to.” An unfamiliar rule can send incoming messages elsewhere, so review it separately from device sessions and app permissions.
5. Check forwarding and POP/IMAP settings
Inspect Gmail’s forwarding and POP/IMAP settings for unfamiliar destinations or configurations. These mail-routing controls are separate from the device and app lists, so signing out of a device does not change them.
6. Confirm recovery information
Make sure the recovery phone number and email address are still under your control. OKDIARIO reports that a changed recovery phone may take up to 7 days to take effect, and Google may continue sending codes to the previous recovery information during that period. Some steps on company- or school-managed accounts may depend on an administrator.
