Unusual Activity on Your Samsung Account
If your Samsung account has been compromised, you might notice strange things happening. Pay close attention to these indicators, as they can be early warnings.
- Unexpected emails from Samsung about password changes or account access that you didn't initiate. Check your spam or junk folders too.
- New devices appearing in your registered devices list on your Samsung account webpage (
account.samsung.com) that you do not recognise. - Changes to your profile information, such as your name, date of birth, or contact details, that you did not make.
- Inability to log in to your Samsung account despite using the correct password, suggesting it might have been changed by an unauthorised person.
Important
If you notice one or more of these signs, it's crucial to investigate further right away. Do not ignore them.
Unrecognised Activity on Your Device
A compromised Samsung account can sometimes manifest through unusual behaviour on your Galaxy phone itself. Look out for these signs directly on your device.
- Applications being installed or uninstalled without your knowledge. Check your app drawer regularly for unfamiliar apps.
- Unfamiliar purchases or subscriptions appearing on your billing statements linked to your Samsung account. Review these statements carefully.
- Your phone's settings being changed without your input, such as new language settings or altered security preferences. Go to Settings to review.
- Messages or calls being sent from your phone that you didn't send. Check your messaging and call logs for anything out of place.
Good to know
Some apps might change settings for legitimate reasons. Always cross-reference with other signs of compromise.
Checking Your Samsung Account Security Settings
You can directly check your Samsung account's security status on the web to look for signs of unauthorised access. This is a key step in confirming a compromise.
- Visit the Samsung account website at
account.samsung.comand log in. - Navigate to Security and privacy or similar section.
- Look at Activity history or Recent access to see a log of when and where your account has been accessed. Pay attention to unfamiliar locations or times.
- Review the Registered devices list to ensure all devices linked to your account are yours and that there are no unknown additions.
- Check your recovery email and phone number listed under Profile information to ensure they haven't been changed by an attacker.
Tip
Regularly reviewing your account activity and registered devices can help you spot issues early.
Investigating Find My Mobile and Secure Folder Activity
If your Samsung account is compromised, attackers might try to access or manipulate features like Find My Mobile or Secure Folder. Always investigate these areas.
- Check the Find My Mobile website (
findmymobile.samsung.com) for any unfamiliar location tracking, lock attempts, or data wipe commands that you didn't initiate. - On your phone, go to Settings → Security and privacy → Find My Mobile and ensure its settings haven't been altered.
- Look for any new or unfamiliar apps within your Secure Folder, or if the Secure Folder itself has been unexpectedly removed or reset on your device.
- If you use Knox security, check its status and settings for any unauthorized changes or alerts within the Knox app or related settings.
Important
Unauthorised use of Find My Mobile could indicate an attempt to track your location or wipe your device. Act swiftly if you see this.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers