Someone else may be in my account — what to do

If you think someone else has access to your account, do these two things in this order.

1. Sign out everywhere.
Settings -> Two-factor authentication -> Sign out everywhere. This ends every signed-in session on every device and stops trusting all of them, so whoever else is signed in loses access immediately and has to pass verification again to get back in.

It signs you out too. That is not a side effect — "everywhere" has to include the device you are on, or the promise is not true. You will sign in again straight afterwards.

2. Change your password.
Settings -> Profile -> Change password. You will be asked for your current password first, which is how we know it is you and not the session you are trying to evict.

Why the order matters:
Changing your password also ends every existing session now, so either step alone will evict them. Doing both means the intruder is out AND cannot get back in with the password they had.

What "stops trusting all of them" means:
A trusted device is allowed to skip the second-factor prompt for 30 days. If you only ended sessions and left the trust in place, an attacker on a trusted device could sign in again and skip the very check meant to stop them. Signing out everywhere clears both together.

If you cannot sign in at all:
Use a recovery code at the sign-in prompt ("I lost my authenticator"), then follow the steps above. If you have no recovery codes and no access to your second factor, see "Lost your phone or authenticator".