Review signed-in devices and connected apps from time to time
The device list shows phones and computers that can still access your account. An intruder may remain quiet before doing anything obvious. If you spot an unfamiliar device or an old app that still has access, sign out all sessions and change the password.
What it takes
Free, and only a few minutes each time. The challenge is remembering to do it without a reminder.
What you may gain
Account takeovers do not always lead to immediate activity. The signed-in device list shows which devices retain access; the authorized-app list shows other services you have allowed to connect to the account. Unfamiliar devices and unused third-party apps are among the easiest traces to spot.
Context & considerations
WeChat, Alipay, email services, Apple accounts and Android-related accounts provide versions of these settings. If a device is unfamiliar, sign out all sessions, then change your password.
Research & references
Practical experience; no direct research reference.