Why did I get a "new device signed in" email?

If you signed in at my.donately.com, for example to update an expired card, you may get an email a moment later with the subject "New device signed in to your Donately account".

It is a routine security notice, not a warning that something is wrong. We send it so that a sign-in you did not make never goes unnoticed.

The short version: if you signed in around the time the email arrived, that sign-in was you, and there is nothing to do.

What the email says

The body lists four details about the sign-in:

• Sign in type: how you got in, usually Email code or Password.
• Device: the browser and operating system, for example Chrome on Windows.
• Location: a city and country, with the internet address in brackets.
• Time: the date and time, in UTC.

Below that is a link to immediately sign that device out, and our support address.

Why the details often look a little wrong

All four lines are an estimate based on how your internet connection appears to us. They are frequently close but not exact, and that is normal.

The location is your internet provider, not your address

The city is worked out from the internet address your connection is using, which belongs to your internet provider or mobile carrier, not to you. Their equipment is often in a larger town nearby, so the alert can name a city 10 or 50 miles from where you are actually sitting. On a phone using mobile data it can be much further, because carriers route traffic through regional hubs.

A nearby or regional city is expected. A city on the other side of the country, or another country, when you have not travelled or used a VPN, is worth a second look.

"New device" does not mean a device you have never used

The alert is really about a new browser session, not new hardware. You will see it on a computer you have owned for years if any of these apply:

• You have not signed in on that computer for a while, or have never signed in to Donately on it before.
• You used a different browser than usual, for example Edge instead of Chrome.
• You were in a private or incognito window.
• You cleared your cookies or browsing history, or your browser cleared them for you.
• You signed in on your phone rather than your computer, or the other way around.

It is also worth saying what does not count. Reading a newsletter, opening a receipt, clicking through to a campaign page, or making a donation on a form are not sign-ins, so they never trigger this email. Only signing in to your donor dashboard does.

The time is in UTC

The timestamp is UTC, not your local time. In the United States that is 4 to 8 hours ahead of your clock depending on your time zone and the time of year, so an afternoon sign-in can be stamped with an evening time. Convert before deciding a sign-in looks suspicious.

Was it you? A quick check

1. Were you signing in around then? Allow for the UTC offset above. If yes, you are done.
2. Does the device line roughly match what you were using? Browser and operating system are what matter, not the exact version.
3. Is the location your area, or your provider's nearest hub?

If all three fit, no action is needed. You can delete the email.

If it was not you

Act on it, in this order:

1. Sign that session out. Use the link in the email, which immediately ends that session.
2. Change your password. Sign in at my.donately.com, open Settings, and expand Security. You can change your password there, and review the devices currently signed in and sign any of them out.
3. Turn on two-factor authentication in the same Security section. It means a password alone is not enough to get in.
4. Email support@donately.com and tell us what you saw. Include the date, time and location from the alert.

Your card details are worth knowing about here: Donately never stores full card numbers, and your donor dashboard only ever shows the last four digits and the expiry. There is nothing in the dashboard that lets anyone see or re-use a saved card elsewhere.

Is the email itself genuine?

Phishing messages imitate security alerts, so it is a fair question.

A genuine Donately alert:

• Asks you to sign a device out, never to "verify your account", confirm a payment, or re-enter card details.
• Never asks for your password, card number or bank details. We will not ask for any of those by email, ever.
• Points you at support@donately.com for help.

If anything about a message asks for payment information, treat it as suspicious. Do not click it. Go to my.donately.com directly in your browser and forward the message to support@donately.com.

Can I stop getting these?

Not individually. The alert is part of how sign-ins to Donately are secured, and it is the only way an unauthorised sign-in would reach you, so it stays on for everyone.

If you are getting them more than you expect, the usual cause is a browser that clears cookies when you close it, which makes every visit look like a new session. Staying signed in, or allowing cookies for my.donately.com, cuts them down.

If you are an organization's admin, not a donor

The same alert covers admin.donately.com, and everything above applies. Your security controls are in User settings → Security, where you can change your password, turn on two-factor authentication, and review the devices signed in to your account.

Related

• Set up your donor dashboard
• Change or cancel your recurring donation, including updating an expired card
• How do I know my information is secure?