"Couldn't Sign You In" / Suspicious Activity on Google? Secure It and Set Up 2-Step Verification

You tried to sign in and got “Couldn’t sign you in” or “We’ve detected suspicious activity in your account,” or you got an email about an unusual sign-in or a new device.

Why: Google watches for sign-ins that don’t match your usual device or location and steps in to protect the account. Sometimes it’s a real intrusion attempt; sometimes it’s just you on a new phone, VPN, or fresh browser. Either way the fix is the same: confirm what happened, secure the account, and then turn on 2-Step Verification so a stolen password alone can’t get anyone in.

Fix 1: Investigate the suspicious activity

Start by confirming whether the flagged sign-in was you:

1. Go to myaccount.google.com → Security.
2. Under Recent security activity, review the listed sign-ins and devices. If you recognize them, you can mark them as you.
3. Under Your devices, click Manage all devices; for anything you don’t recognize, click it and choose Sign out.

If it really was you on a new device, confirming it usually clears the block.

Fix 2: If it wasn’t you — secure the account now

Treat an unknown sign-in as a compromise and lock it down:

1. Change your password at myaccount.google.com → Security → Password. Use something you’ve never used elsewhere.
2. Re-check Recovery phone and Recovery email under Security — remove anything you didn’t add.
3. In Gmail → Settings → See all settings → Forwarding and POP/IMAP and Filters and Blocked Addresses, delete any forwarding rule or filter you don’t recognize (a classic attacker trick to siphon your mail).
4. Review Security → Your connected apps & services (third-party access) and remove anything unfamiliar.

Note: if Google disabled a suspicious recovery method it added, you have 30 days from the warning to confirm it before it’s deleted.

Fix 3: Run Security Checkup

Google’s Security Checkup walks you through everything above in one pass and flags problems:

• Go to myaccount.google.com/security-checkup.
• Work through each section it flags (devices, recent activity, 2-Step Verification, third-party access). Anything marked needs your attention.

Fix 4: Turn on 2-Step Verification (and app passwords)

This is the single best way to stop “suspicious sign-in” blocks for good — a password alone won’t be enough.

Turn on 2-Step Verification:

1. Go to myaccount.google.com → Security.
2. Under How you sign in to Google, click 2-Step Verification and follow the prompts.
3. Add at least one second step — passkey, Google prompt (a tap on your phone), Google Authenticator codes, or a text/voice code.
4. Save backup codes: download or print the set of backup codes and keep them somewhere safe — they get you in if you lose your phone.

App passwords (only for old apps that don’t support modern sign-in):

Some older mail programs can’t do the second step. For those, generate a 16-digit app password:

1. 2-Step Verification must be on first.
2. Go to myaccount.google.com/apppasswords.
3. Name the app/device and click Create — you’ll get a 16-digit code.
4. Enter that code in place of your password in that app, once.

Whenever possible use “Sign in with Google” instead — app passwords are a fallback, and Google revokes them automatically when you change your account password (just generate a new one).

FAQ

It really was me on a new phone — why blocked? Google didn’t recognize the device or location. Approve the sign-in on a trusted device or complete the verification and it’ll clear.

Will app passwords work without 2-Step Verification? No. App passwords only exist on accounts that have 2-Step Verification turned on.

I lost my phone and can’t do the second step. Use a saved backup code, or recover the account at accounts.google.com/signin/recovery.

Sources: Google Account Help — Investigate suspicious activity on your account, Google Account Help — Turn on 2-Step Verification, Google Account Help — Sign in with app passwords