Indicators of Account Compromise

How would you know if one of your accounts was hacked? It’s not always obvious. But I’ll tell you where to look.

Sometimes it’s obvious when your accounts are hacked. Maybe your money is gone. Maybe you can no longer log in using the password you know is correct. Maybe everyone you know has gotten a scam email from you that you didn’t send. But sometimes bad guys aren’t so obvious. They may lurk around in your accounts to gather information for identity theft or in hopes of gaining access to other more lucrative accounts.

Clues of Compromise

So, how would you know if someone had surreptitiously gained access to one of your accounts? There are several clues that could tip you off, which I’ve listed below. HOWEVER: Please keep in mind as you read through this list that there are often other, perfectly valid reasons you might see some of these things. For example, some of these conditions can be triggered if you use a VPN, connect to the internet from a public Wi-Fi hot spot, or share your account with someone else. And sometimes we accidentally make changes to our accounts or forget that we did something.

With those caveats in mind, here are some potentially suspicious activities to check for:

• Unfamiliar Logins in Activity History: While reviewing account activity, you might notice logins from unfamiliar locations or devices, even if no action was taken during those sessions.
• Changes to Recovery Information: Updates to your an account’s recovery options, such as an added phone number or alternate email address, may be a red flag that someone is trying to secure their own access.
• Email Forwarding Rules: In your email settings, check for any forwarding rules that weren’t created by you. Attackers sometimes set these up to monitor or redirect incoming messages without alerting you.
• Unexpected Two-Factor Authentication (2FA) Requests: Receiving unexpected 2FA prompts could indicate someone is attempting to log into your account or has access to your credentials but is being stopped by the extra security.
• New Devices or Sessions: Seeing new, unfamiliar devices connected to your account under security settings could indicate that someone has logged in using your credentials.
• Unusual Activity Alerts: Some platforms automatically flag suspicious activity, like logging in from a new device, browser, or location. These alerts can be subtle but are worth investigating even if you recognize the locations as legitimate. (If your account offers these options, you should consider enabling them if they’re not on by default.)
• Account Settings Changes: Small changes in settings, like privacy settings, notification preferences, or language changes, can indicate that someone has tampered with your account, possibly to cover their tracks.
• Slight Behavioral Anomalies: For social media, changes in your feed or the types of content that appear might indicate the attacker has interacted with specific posts or topics. Similarly, new ‘likes’ or follows you didn’t initiate could suggest an unauthorized presence.
• Password Resets or Failed Login Attempts: Seeing password reset emails or failed login notifications that weren’t triggered by you can be subtle clues that someone is trying to gain access, even if unsuccessful.
• Missing Emails or Posts: Deletions of emails, messages, or posts that you didn’t authorize may signal that someone is trying to clean up traces of their activity or remove specific communications.

So What Do I Do Now?

If, after reading that list, you believe one or more of your accounts may have been compromised, I would do the following things. Understand that if someone has gotten into your account, they can do anything you can do. Also, if your Google, Facebook or other “Login with…” accounts were compromised, then the attacker can access all of those other accounts, too. You should consider breaking that “Login with” link and creating a dedicated account with unique credentials. Consider using an email alias.

• Change your password immediately. Use a strong, unique password. I would strongly recommend using a password manager, but if you don’t have one set up, you can do that later. First and foremost, you need to lock the bad guy out of your account (and prevent them from locking you out).
• Check related accounts. If you used the compromised credentials on any other accounts, you need to change those passwords right away, too. Obviously, this time they should be different for each account.
• Enable two-factor authentication (2FA). If the account in question offers 2FA, enable it. See these two articles for help and important info.
• Check for unauthorized access, connected apps/devices. See below articles for help with this.
• Update Security Questions and Recovery Information. Review your account recovery settings – make sure no new methods/devices were added and consider changing your security questions. See this article for important considerations.
• Notify Contacts: If it’s likely that the attacker has used your account to send messages or post on social media, notify your contacts or followers. Let them know to be cautious of any unexpected messages from you.
• Contact the Service Provider: Most services have dedicated procedures for handling compromised accounts. Look for the account recovery or support section and follow their guidance, especially if you’re locked out of your account.
• Monitor for Further Issues: After securing the account, continue monitoring it for any unusual activity. If anything seems off again, repeat these steps.

You may not know how to do some of the things above. For example, not many people know that most online accounts today keep logs of recent activity and keep a list of all connected devices. This is an excellent tool for discovering unauthorized access to your accounts. I recently ran across two excellent articles. They have step-by-step instructions for checking your email, messaging and social media accounts for signs of compromise.

• Tuta: How to tell if your accounts have been hacked
• TechCrunch: How to tell if your online accounts have been hacked

It’s easy to get paranoid after reading an article like this, and that’s not my intent. Honestly, I’m hoping that the above techniques will most often put your mind at ease when you find that none of them apply – or that you can explain any that do. If you have strong, unique passwords for all your important accounts and two-factor authentication, your accounts will be safe. So if nothing else, maybe this is a good opportunity to get them up to snuff.