Why you got a "new login" email and what to do

If you got an email titled "New sign-in to your Eflexsim account" from security@eflexsim.com, it means your account was signed into from a device we hadn't seen on it before. If that was you — a new phone, a new laptop, a browser you don't normally use — there's nothing to do. If it wasn't you, change your password and email support@eflexsim.com asking us to sign all sessions out of your account.

Below: exactly what triggers the alert, what it does and doesn't tell you, and what to do if it wasn't you.

What triggers the alert

A device we haven't seen on your account before. That is the only trigger.

We identify a device by its browser-and-operating-system signature, in a way that ignores version numbers — so a browser update or an OS update does not count as a new device and won't alert you.

You get one alert the first time a device is used, and never again for that same device.

What does NOT trigger it

This matters, because it sets what the alert can and can't tell you:

• Not a new country or city. Signing in from abroad on a phone you've used before will not alert you. Travel doesn't trigger it.
• Not a VPN or a changed IP address. We deliberately don't key on IP — mobile IP addresses change constantly and would alert you all day.
• Not a long gap since your last sign-in.
• Not a failed sign-in. The alert only ever means a sign-in succeeded. Someone guessing your password and failing produces no email.

What the alert contains

Three things:

• The account it relates to.
• When the sign-in happened.
• A short description of the device — the browser and operating system.

And one thing it deliberately does not contain:

• A location. No city, no country, no IP address. We don't resolve a location for these sign-ins, so we don't print one. An alert that guessed a city from how a network happened to route would be worse than saying nothing.

The email has a Review your devices button that takes you to Account → Account details → Security.

An honest limitation on mobile

Phones running the Eflexsim app report a device signature that's nearly identical across different handsets of the same type and OS version. So on mobile this is closer to "a new kind of device" than "a new physical phone" — a second iPhone signing into your account may not produce an alert.

Treat the alert as a useful signal when it arrives, not as complete coverage. It's a smoke detector, not a perimeter.

Was it you?

Cases where the alert is expected and needs no action:

• You bought a new phone, tablet, or laptop.
• You signed in on a browser you don't usually use — Firefox when you normally use Chrome, or a friend's computer.
• You signed in on a work machine for the first time.
• You installed the Eflexsim app on a device that had only ever used the website.

If any of those match the timing, it was you.

If it wasn't you

Work through these in order.

1. Change your password.

1. Sign in at eflexsim.com.
2. Go to Account → Account details → Security.
3. Enter your current password, then your new one — minimum 12 characters.
4. Save.

If you can't sign in because the password has already been changed, use how to reset my password instead.

2. Email support and ask us to sign all sessions out.

Changing your password does not by itself sign other devices out, and there's no button on the site that does it. Someone already signed in stays signed in until sessions are ended.

Email support@eflexsim.com, subject "Possible unauthorised access", with your account email. We can sign every session out of your account, which removes anyone else immediately.

3. Check for activity you don't recognise.

• Account → Orders — purchases you didn't make.
• Account → Wallet — credit that has moved.
• Account → Saved cards — cards you didn't add.

Tell support about anything that looks wrong. We'll refund a purchase you didn't make.

4. Change the password anywhere else you reused it.

If your Eflexsim password was also your email password, deal with the email account first — whoever controls your inbox can reset your Eflexsim password whenever they like.

What you can see in your account

Account → Account details → Security shows the device you're currently signed in on. It does not yet show a history of past sign-ins, and there's no button to sign out an individual device — the only way to end other sessions today is to ask support.

We'd rather say that plainly than describe a screen that isn't there.

Frequently asked questions

QCan I turn these alerts off?

No. Security alerts always send, regardless of your email preferences. The marketing toggles at /email-preferences don't affect them.

QI got an alert but I'm sure nobody else has my password.

The most likely explanation is a device of yours we hadn't recorded — a new browser, a browser after a profile reset, or a private window. It never fires on a failed sign-in, so an alert does mean a real sign-in with the correct password.

QWhy doesn't the alert tell me where the sign-in came from?

Because we don't know. We don't run a location lookup on sign-ins, and we won't print a guess on a security email.

QCan I see every past sign-in to my account?

Not today. The Security screen shows your current device only.

QCan I get these as a push notification instead of email?

No. Email is the only channel for security alerts.

QI got the alert twice for the same laptop.

That usually means the browser signature changed between the two sign-ins — a different browser, or the same browser after a reset. Each distinct signature alerts once.

QDoes signing in on a new device sign my other devices out?

No. You can be signed in on several devices at once. That's also why ending other sessions needs support.

For password resets, see how to reset my password. For account recovery, see lost access to your email. For what does and doesn't protect your account, see does Eflexsim have two-factor authentication.