Many services does this nowadays. When you login you get an e-mail stating that a "new login was made with [browser] on [plattform]".

The e-mail then has some info on IP the login was made from etc. and a text that says something like:

"If this was you, great! There's nothing else you need to do.

If you do not recognize this login, …"

Add a global setting so this can be turned of but enable it by default.