Gmail’s Last account activity, Google’s device-session list, and recent security events provide different evidence. Use the view that matches your question, then cross-check anything unfamiliar.
Use Gmail Details for mail access
On a computer, open Gmail and look at the bottom right for Details beside the last account activity information. Google’s guide says this view includes concurrent-session information, access type, and recent IP addresses with approximate locations.
It can show whether access came through a browser, device, mail server, or authorized application. A POP or IMAP client and a third-party application can therefore explain entries that differ from your normal browser connection.
Use the device list for sessions
Open Google Account Security & sign-in → Manage all devices to review current and recent sessions. The same device can have several sessions, and their last communication can include background synchronization.
This list is useful for signing out access from a device. A signed-out entry can remain as history; its presence does not necessarily mean current access.
Use security events for important changes
Recent security activity highlights security-related events and gives you controls to respond to unfamiliar activity. A warning about a blocked action differs from a successful sign-in or a change to recovery information.
Do not treat any one view as a complete forensic record of every email read, file downloaded, or copy made.
Interpret locations carefully
Gmail says mobile-provider locations can be far from the user’s actual position. An authorized app may also show the app’s network address. Compare access type, timing, and your own devices before deciding whether the location is suspicious.
Google’s Gmail guide describes a limited recent IP history. It should not be presented as an unlimited historical log you can use to reconstruct all past access.
Act on unexplained access
If you cannot explain active access or see unauthorized changes, follow Google’s compromised-account process. Change the password from a trusted device, inspect recovery and sign-in methods, and review Gmail forwarding and filters.
For a managed account, ask the administrator to investigate organization logs. Keep relevant details private and avoid drawing conclusions about a specific person from an approximate city or an IP address alone.
Official references
Reviewed against Google’s official guidance on October 27, 2026. Available options and screen labels can vary by account, device, region, and organization policy.