Periodically check the devices logged into your account and any authorized apps, then remove the ones you no longer use

No cost at all. It only takes a few minutes each time. The hard part is that there’s no reminder — you have to remember to do it yourself.

The account's device list records phones and computers that can still use it. The authorized-app list records other companies' software you allowed to sign in with that account. Unfamiliar devices and long-unused third-party apps are the easiest traces to spot. The UK's National Cyber Security Centre lists logins or attempted logins from unfamiliar places or at unusual times as signs to investigate for account compromise. It also says criminals often set up an email-forwarding rule that copies every message to them, allowing password resets. Its sequence is: remove unknown forwarding rules first, change the password, then sign out every device and app. After sign-out, anyone trying to use the account needs the new password. The US Federal Trade Commission likewise advises signing out all devices after recovering an account and removing forwarding rules you did not create.

UK NCSC. Recovering a hacked account. https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account；US FTC. How To Recover Your Hacked Email or Social Media Account. https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account；两份都是账号出事以后的处理指南，「隔一段时间主动去看」是作者经验

You can find this setting in WeChat, Alipay, email, Apple and Android accounts. On finding an unfamiliar device, change the password first, then sign out all sessions; this is the sequence given by the UK's National Cyber Security Centre. Rated C because both sources are official operating guides; no study has calculated how much regular checks prevent in losses.