Where to look
Settings → Privacy and Security → Devices lists every active session with device type, system, approximate region and last active time.
Ending sessions
- Tap a device and choose Terminate to sign it out instantly;
- If needed, choose Terminate All Other Sessions;
- Change your two-step verification password afterwards.
Prevention
- Enable two-step verification so new devices need an extra password;
- Set auto-logout after inactivity, for example one month;
- Always terminate web sessions after using a public computer.