Recognizing the Signs of a Compromised Account

What “Compromised” Means

An account is compromised when someone other than its rightful owner can use it, or when the owner can no longer be sure that they alone can. Attackers get in through phished passwords, reused credentials leaked from other services, malware that steals saved logins, guessed passwords, or a weakness at the service itself. Once inside, they may read data, send messages, change settings or move on to other systems.

Accounts are attractive because they look like legitimate users. Activity from a stolen account can blend in with normal behavior for days or weeks, so noticing small oddities early matters.

Signs Users Might Notice

Ordinary users are often the first to spot a problem. Signs worth reporting include:

• Password no longer works, or the reset request arrives without the user asking for it.
• Security notifications they did not trigger, such as alerts about a new device or location, or codes sent by text or app when they were not signing in.
• Messages in the sent folder that the user did not write, or replies to emails they never sent.
• Contacts reporting strange messages that appear to come from the account, often with odd links or urgent requests.
• Changed settings, including a new recovery email or phone number, new forwarding rules, or a changed display name.
• Missing or deleted emails, especially security alerts or financial messages. Attackers sometimes hide their activity this way.
• Unfamiliar logged-in devices or sessions in the account’s security page.
• Unexpected purchases, transfers or posts on accounts linked to payment or social media.

Any one of these can have an innocent explanation. A new-location alert may simply be a phone on mobile data. Several signs together deserve quick attention.

Signs Administrators Might See

People who manage systems have more data to work with. Typical indicators in logs and monitoring include:

• Sign-ins from unusual places, especially two distant locations within a short time that make real travel implausible.
• Sign-ins at odd hours for that person’s usual pattern.
• Many failed attempts followed by a success, which can suggest password guessing.
• A burst of failures across many accounts from one source, sometimes called password spraying.
• Sign-ins from unfamiliar devices, browsers or automated clients.
• New mailbox rules that forward or hide messages.
• An account suddenly accessing systems or data it has never used, or downloading unusually large amounts.
• Changes to security settings, such as turning off multi-factor authentication or adding a new authentication method.
• Privilege changes, like an account added to an administrative group without a request.
• Activity from accounts that should be dormant, including accounts of people who have left. Good account offboarding reduces this risk.

Reading system logs regularly, and having alerts for some of these patterns, makes detection much faster. Be careful with assumptions: a VPN, travel or a new laptop can all explain behavior that looks suspicious at first glance.

Service Accounts Need Extra Attention

Accounts used by software rather than people rarely have a person watching them. Because they often hold broad permissions and long-lived passwords, a compromised one can be especially damaging. Unusual interactive sign-ins or access from unexpected machines for such an account are worth investigating. Careful handling of service accounts, including owners and periodic review, helps.

What to Do If You Suspect a Problem

For a user:

1. Stop and do not ignore it. Report to the help desk or security contact promptly.
2. Use a different, trusted device if you suspect the one you are on is infected.
3. Change the password to a new, unique one, but follow your organization’s instructions about timing, since responders may want to look first.
4. Check recovery options and forwarding rules and remove anything unfamiliar.
5. Sign out of all sessions if the service allows it.
6. Change the same password anywhere else it was used.

For an administrator, the general approach is to confirm and scope the issue, then contain it by resetting credentials, revoking sessions and tokens, and disabling suspicious rules, while keeping logs for investigation. After that, look for what the account touched, since the attacker may have gained other credentials or sent phishing to colleagues. This follows the same lines as incident containment more broadly.

If personal data might have been viewed, privacy obligations may apply, so involve the people responsible for privacy early.

Making Takeover Harder

No step makes takeover impossible, but several reduce the odds and the damage:

• Use unique, strong passwords, ideally stored in a password manager.
• Turn on multi-factor sign-in wherever offered. Some methods resist phishing better than others, but nearly any second factor is better than none.
• Apply least privilege, so one stolen account can reach less.
• Run regular access reviews to remove unneeded accounts and permissions.
• Teach staff to report odd messages and unexpected prompts, particularly repeated approval requests they did not initiate.

Treat each suspicious sign as information rather than proof. Verifying quickly, and being comfortable reporting something that turns out to be harmless, is a healthy habit for both users and responders.