Understanding Account Takeover Evidence

Account takeover is one of the most common incident types. Evidence typically spans identity providers, email systems, and the applications the compromised account accessed.

Authentication anomalies

Look for logins from unfamiliar locations, impossible travel patterns, authentication from new devices, and successful logins immediately following failed attempts.

Email and communication evidence

Forwarded email rules, deleted messages, and sent items the account holder did not authorise often reveal attacker activity after takeover.

Application access patterns

Review what resources the account accessed after the suspected compromise. Data downloads, permission changes, and API key creation are common post-takeover activities.