When a trusted device is no longer trusted

A device becomes trusted through controls and behaviour, not familiarity. A phone may be shared with a household employee, a laptop may be left unlocked in a hotel and a browser session may remain active after a contractor’s work is finished. Review who can unlock each device, which accounts remain signed in and whether recovery codes are stored nearby. Use separate profiles where possible, enable theft protection and revoke sessions after a loss or change of role. The question is not whether the device looks familiar; it is whether the current person, session and recovery path are still understood.