A disputed login at 02:13, an unfamiliar recovery email, then a payment instruction sent in a director’s name: these are not merely IT anomalies. They may be indicators of account takeover. For a business, they can signal fraud, data theft or insider involvement. For a legal case, they may become central to establishing who accessed an account, what they did, and whether the available evidence can withstand challenge.
An account takeover occurs when an unauthorised person obtains control of an online account, usually by acquiring credentials, intercepting a one-time code, exploiting a reused password, stealing an active session, or changing recovery details. The affected account might be email, Microsoft 365, Google Workspace, a cloud storage service, banking platform, social media account or line-of-business system. The technical route matters, but so does the evidential question: what can be reliably shown from the available records?
Indicators of Account Takeover in Digital Evidence
No single alert proves an account takeover. A foreign IP address may belong to a legitimate traveller, a virtual private network, a mobile network exit point or a corporate security service. A password reset may have been initiated by the genuine user. Sound investigation tests competing explanations rather than treating a suspicious event as a conclusion.
The strongest cases are built from a sequence of corroborating events. A login from a new device may be followed by changes to multi-factor authentication, mailbox rules, cloud downloads and messages sent to selected recipients. Taken together, these events can show both access and purpose.
Unrecognised logins, devices and sessions
Authentication records are often the starting point. Investigators may identify logins from unfamiliar IP addresses, locations, browsers, operating systems or device identifiers. Failed sign-in attempts immediately before a successful login can be particularly significant, especially where they indicate password spraying, credential stuffing or repeated attempts against one user.
However, geolocation should be handled carefully. It is an estimate derived from network information, not a precise finding of a person’s physical location. A defensible report distinguishes between what a log states, what may reasonably be inferred, and what cannot be determined.
It is also necessary to examine session activity. An intruder who has stolen a valid browser session may access an account without a fresh password login. Security logs showing unusual token use, unexpected session persistence or access from a new device shortly after a phishing event may therefore be more revealing than password events alone.
Changes to account security and recovery details
Takeover activity often begins with the attacker securing their own access. Warning signs include a changed password, amended recovery email address or telephone number, newly enrolled authenticator app, altered multi-factor authentication method, new passkey, unfamiliar trusted device or modified security questions.
These changes can lock out the legitimate user while enabling the intruder to retain control. The precise timing is important. If recovery details changed minutes after an unusual login, followed by the removal of a known device, the chronology may support an inference of unauthorised control. If the changes were made during a documented device replacement or employee onboarding process, the explanation may be entirely innocent.
Mailbox rules, forwarding and impersonation
Business email compromise frequently relies on quiet persistence. An attacker may create inbox rules that move security alerts, payment correspondence or replies from a particular customer into archive, deleted items or RSS folders. They may set automatic forwarding to an external address, delegate access, or create a rule that marks messages as read before the account holder sees them.
Sent items, deleted items, mailbox audit logs and message trace records can help establish whether messages were created, sent, forwarded or removed. A display name that resembles a director, supplier or solicitor is not itself proof of access to that person’s genuine mailbox. Header information, tenant audit records and the surrounding account activity must be examined before attribution is attempted.
Unusual access to files, contacts and financial information
A takeover may be motivated by intelligence gathering rather than immediate fraud. Downloads of large quantities of cloud data, searches for terms such as “invoice”, “bank”, “settlement” or “password”, export of contacts, access to payroll folders and viewing of confidential case materials may all require investigation.
The context is decisive. A user in finance may legitimately access invoices every day. A departing employee who accesses a restricted client folder at an unusual time, from an unmanaged device, shortly before forwarding documents outside the organisation presents a materially different evidential picture.
Changes to payments, suppliers or communications
A sudden amendment to bank details, new payment beneficiaries, unusual invoice wording or pressure to bypass normal approval processes can be the visible consequence of a compromised account. In legal and corporate investigations, preserve the original emails and their metadata before messages are forwarded, printed or copied into a new thread.
Where a disputed payment is involved, investigators should compare timestamps across email records, banking records, endpoint activity and communications with the purported supplier. This may reveal whether the instruction came from a compromised mailbox, a lookalike domain, a forged email, or a legitimate account used by an authorised person.
What to Preserve When Takeover Is Suspected
The first response can determine whether the evidence remains useful. It is understandable to reset passwords, revoke sessions and delete suspicious emails immediately. Those steps may be necessary to contain risk, but they can also overwrite or disperse material needed later in disciplinary proceedings, civil litigation, insurance claims or a criminal investigation.
Preservation and containment should proceed together where possible. Record who identified the incident, when it was identified, which account was affected, and the immediate actions taken. Capture screenshots only as an initial record, not as a substitute for obtaining native logs and original data.
Relevant material may include:
- identity provider and application audit logs, including sign-ins, session data, device details and administrator actions;
- original emails with full headers, message trace information, mailbox rules and delegation settings;
- cloud audit records showing file views, downloads, sharing changes, deletion and external transfers;
- endpoint artefacts from affected computers and mobile devices, such as browser history, authentication prompts, malware traces and local files; and
- contemporaneous witness accounts, incident tickets, password reset notices and communications with banks, suppliers or service providers.
Retention windows can be short, particularly for certain cloud and security logs. Organisations should identify the relevant systems promptly and place proportionate legal or internal preservation measures in place. A personal device, employee mailbox or shared family account may also raise privacy, employment and data-protection considerations. The scope of collection should be lawful, necessary and documented.
From Suspicion to a Defensible Finding
The question in a forensic investigation is rarely just whether an account was used. It is whether the available evidence supports a reliable account of how access occurred, what actions followed, and whether a particular individual can properly be associated with those actions.
Attribution demands caution. An IP address may identify a connection, not a person. A device may be shared. Credentials may have been voluntarily disclosed, phished or recovered by a third party. Conversely, the absence of malware does not rule out compromise where an attacker used valid credentials.
A structured examination should preserve original material, record hashes where applicable, document acquisition methods and maintain chain of custody. Investigators can then build a timeline across authentication events, email activity, cloud records, endpoint artefacts and communications. That approach exposes gaps as well as supporting evidence, which is essential where findings may be tested by opposing parties, regulators or a court.
Computer Forensics Lab approaches suspected account compromise as an evidential matter, not simply a technical support issue. The objective is to recover and analyse relevant digital material independently, identify what can and cannot be established, and present the findings in clear, court-ready reporting.
A suspicious login may be the first warning, but it should not be the final finding. Act quickly to limit further access, preserve the records that explain what happened, and ensure that any investigation is capable of answering the questions that follow.