Last updated: November 01, 2026

Key Takeaways

• You need account access, a second trusted device if needed, and time to review sessions and connected apps.
• Revoke access by checking active sessions, signing out unknown devices, and removing unfamiliar connected apps.
• Find sessions in each service’s device or sign-in history, though the labels vary.
• Remove connected apps by revoking OAuth permission in the account settings, not by deleting the app from your phone.

A scam can cling to an account even after the password changes. In How to Revoke Access to Suspicious Apps and Sessions, the real fix is to revoke account sessions, remove suspicious connected apps, and cut off third-party access so old tokens stop working.

What you need before you start

Access to the account itself comes first. You may also need a second device if the main one is compromised, plus enough time to check both sessions and connected apps. If you can still sign in, do the work from a trusted phone or laptop on a clean network — not the device that flashed the warning.

Have these ready:

• the email address or phone number on the account
• the account password if you still know it
• the name of the suspicious app, if one appeared in a sign-in alert or email
• a list of devices you recognize, such as an iPhone, Windows PC, or Android tablet

This is not cosmetic cleanup. Account sessions and app access are separate controls. A password change can stop some attackers, but an active session or OAuth permission can keep giving access until you remove it. For account-specific recovery steps, see the guide on securing accounts after a scam attempt and the device security checklist.

How do I revoke access to suspicious apps and sessions?

Check the account’s active sessions first. Then sign out of unknown devices, and only after that remove any connected app you do not recognize. Start on the security page for the account you are worried about; the order matters.

Use this order:

1. Open the account’s security or device page.
   For a Google Account, Apple ID, Facebook, or Microsoft account, look for headings like Security, Devices, Where you’re signed in, or Recent activity. When it works, you will see a list of phones, tablets, browsers, or app names tied to the account.

2. Review active sessions one by one.
   Look for location, device model, browser, and last activity time. A session from a device you do not own, or one that shows a city you have never visited, is the one to remove. The result you want is a shorter list with only your trusted devices left.

3. Use the sign-out option for unknown sessions.
   Choose Sign out, Log out, Remove device, or Sign out everywhere if the account offers it. On many services, the old browser or app may keep a stale screen for a few minutes, but it should lose fresh access after the token is revoked.

4. Open the connected apps or third-party access page.
   Find sections labeled Connected apps, Third-party access, Apps with account access, or OAuth permissions. A healthy account shows only services you intentionally linked, such as a password manager, a calendar app, or a mail client.

5. Remove anything you do not recognize.
   Click Remove access, Disconnect, or Delete app access. When that works, the app disappears from the list and should no longer be able to read or send account data through OAuth.

6. Change the password after you remove access.
   Do this after the session cleanup, not before it. Changing the password can help, but if you do it first and skip session cleanup, an already-authorized app or browser session may stay alive for a while.

7. Check again from a second device in about 10 to 15 minutes.
   The session list should be shorter, and the suspicious app should stay gone. If a device or app comes back immediately, that can mean the account is still linked to a live login somewhere, so consult the platform’s help or a security professional if you cannot remove it.

For a broader next step, the hub on how to secure accounts and devices after a scam attempt can help with the rest of the cleanup. If anything keeps reappearing, get help from the service provider or a security professional.

Where do I find active sessions in Google Account, Apple ID, Facebook, and Microsoft account?

Each service hides the list under a different label, so expect a little hunting. The fastest route is usually the security screen, then the device list or recent logins.

Here is where to look:

• Google Account: open Security and then Your devices or Recent security activity. You should see device names, approximate locations, and sign-in times.
• Apple ID: open the Apple ID device list in Settings on iPhone, iPad, or Mac. The account shows trusted devices linked to the Apple ID, often by model name.
• Facebook: open Password and security and then Where you’re logged in or Where you’re signed in. You should see sessions by device and browser.
• Microsoft account: open Security and then Sign-in activity or Devices. You may see recent attempts and the devices tied to the account.

The test is blunt: if you cannot match the device, browser, or time to something you used, remove it. A session from a 2021 laptop you sold last year is not harmless just because the password changed afterward.

If the list is noisy and you see one suspicious login, use sign out everywhere when the service offers it. That is usually the better choice when the account is small, personal, and not tied to a work app that would be disrupted by a full reset.

How to remove connected apps and OAuth permissions without breaking things

Remove connected apps by revoking their OAuth permission, not by deleting the app from your phone. That is the part many people miss, and it is why suspicious access survives a password change.

Look for these signs:

• an app you never installed
• an app with a generic name like “Calendar Sync” or “Sign-in Helper”
• a service that suddenly asked for mail, contacts, files, or profile access
• an app connected to an old account you no longer use

What to do:

1. Open the account’s app access page.
2. Read the permission text, not just the app name.
3. Remove any app that is unfamiliar, unnecessary, or tied to the scam.
4. Check whether the app also had mailbox, cloud drive, or contacts access.
5. Re-open the list and confirm it no longer appears.

There is a trade-off here. Removing an app can break login or sync for a legitimate service such as a password manager, backup tool, or mail client. That is not a reason to leave suspicious access in place. It is a reason to reconnect trusted apps later, one at a time, after you are sure the account is clean.

If a service offers OAuth permissions with narrow scopes, that is better than broad access, but it still needs review. A calendar app that can read your inbox is not a harmless calendar app.

What should I do if sign-out everywhere does not seem to work?

Assume one token is still active and move to the strongest cleanup option the service offers. Some platforms revoke sessions immediately; others take a little time, and a logged-in mobile app may look active until it refreshes.

Use these checks:

• reopen the session list after 10 to 15 minutes
• look for a second login method, such as a linked app password or device trust
• check whether the suspicious app has a separate authorization page outside the main account
• remove the device itself if the platform lets you, not just the session

A common mistake is leaving a trusted browser or a “remember this device” sign-in in place while assuming the password change solved it. That math stops working fast. It can cost you another hour of cleanup later, because the attacker may still have a valid session cookie or OAuth token.

Another mistake is deleting the suspicious app from your phone before revoking its access from the account. That only removes the icon. The access token can remain in the account until you disconnect it.

If the account is tied to work, shared files, or a business email system, use the organization’s account controls or contact the admin. A personal sign-out routine is not enough when the account is managed by someone else.

What should I check after the access is gone?

Confirm that only your devices and trusted apps remain, then watch for fresh sign-in alerts for the next 24 hours. That final check matters because a scam attempt often leaves more than one path in the account.

Review these items:

• active sessions list
• connected apps list
• recovery email and recovery phone
• forwarding rules in email, if the account has them
• recent security alerts from the platform

A clean result looks like this: only your current phone and laptop appear, the unknown browser session is gone, and no app you do not recognize still has OAuth access. If a login alert appears after cleanup, that may mean another session, device, or linked app still needs removal, and you may need help from the platform or a security professional.

For Google Account, Apple ID, Facebook, and Microsoft account users, the exact labels differ, but the goal is the same: remove every place the account can still be used without your approval.

What is a connected app?

A connected app is a third-party service that has permission to access part of your account. It may use OAuth so you can sign in without sharing your password with the app itself. That convenience also means the app can keep access until you remove its permission from the account settings.

Should I sign out of all devices after a scam?

Yes, if you do not recognize every active session. Signing out everywhere is often the best way to cut off old browser and app sessions, especially after a phishing attempt or suspicious login alert. The downside is that you will need to sign back in on trusted devices, so expect a few minutes of cleanup afterward.

How do I remove app access from my account?

Open the account’s security or connected apps page, find the app by name, and choose remove, disconnect, or revoke access. Then recheck the list to make sure it is gone. If the app reappears, the account may still have another live session or a separate authorization path that also needs removal.

Compare your cleanup options

FAQ

How long should I wait before checking again?

Check again in about 10 to 15 minutes, then monitor alerts for the next 24 hours.

Can a connected app still work after I change my password?

Yes. If it has OAuth permission, it may keep access until you revoke it in the account settings.

What if I do not recognize the location of a session?

Treat it as suspicious if you cannot match it to your own device or travel history, and remove it if possible.

Do I need to remove the app from my phone too?

You should, if you no longer use it. But the important step is revoking its account access, because deleting the app alone does not remove permission.

Drafted with AI; not yet reviewed by a person.

Admin