Why do I see sign ons to my account from Ghana while I live in the United States?

These sign-ins can indicate either false location data or that someone else has your credentials and is trying to access the account.

What the Ghana sign-ins can mean:

1. Approximate or misleading location
   • Location is based on IP address and network routing, which can be inaccurate.
   • Mobile networks and some ISPs can route traffic through distant locations, so a sign-in from the United States can sometimes appear as coming from another country.
   • Before deciding it is malicious, verify other details such as device, browser, operating system, and app used.
2. Possible unauthorized access
   • If the device, browser, or operating system shown does not match anything used, or if sign-ins occur at times not expected, this can indicate that an attacker has the password and is attempting to sign in.
   • Repeated prompts to approve sign-ins that were not initiated can also indicate someone is trying to use the account.

Steps to stop or reduce these sign-ins:

1. Review recent activity
   • Go to the Security basics page and select Review activity to open the Recent activity page.
   • For any activity that is clearly not from you:
     • If it appears in Unusual activity, expand it and select This wasn’t me.
     • If it appears in Recent activity, expand it and select Secure your account.
2. Change the password immediately
   • From the Security basics page, select Change password.
   • Set a strong, unique password that is not used on any other site.
3. Update security info and strengthen sign-in
   • On the Security basics or Security info pages, confirm that phone numbers and email addresses for security codes are correct and belong only to you.
   • Register and use two-step verification (multi-factor authentication) so that a password alone is not enough to access the account.
4. Treat suspicious sign-ins as potential compromise
   • If you see successful sign-ins from unfamiliar locations, devices, or apps that you did not use, change the password and then go to Security info to review and update security settings.
   • If you see unsuccessful sign-ins, especially many attempts, this can mean someone is trying to guess the password. Multi-factor authentication helps protect against this.
5. If you cannot sign in
   • If at any point the password no longer works, follow the steps in When you can't sign in to your Microsoft account and choose I think someone else is using my Microsoft account during recovery.

Continuing to sign out unknown sessions is useful, but combining that with changing the password, enabling multi-factor authentication, and marking unknown activity as “This wasn’t me” or “Secure your account” is necessary to stop ongoing unauthorized attempts.

References:

• What happens if there's an unusual sign-in to your account
• View your work or school account sign-in activity from My Sign-ins
• I can't sign in to my Microsoft account