Maintenance
Part of Account security: the six ways into an account
Account security risks: six warning signs and where to look
Six account security warning signs ranked by urgency, which accounts to check first, where to read the sign-in list, and losses with no attacker.
A warning sign on an account is a small change you did not make: a recovery address, a mail rule, a sign-in prompt. Reading those signs in the right order starts with the accounts that can reset all the others.
Two kinds of sign exist. Some mean someone else is already in. Others mean you are about to lose your own access, and those have no attacker to appeal to, so they are worth catching just as early.
What to take away
- Check accounts in blast-radius orderwhat an account can reset decides how soon its signs matter.
- The first three warning signs deserve a response tonight. The rest are worth checking.
- Early means the first sign, not the second.
- Some signs involve no attackera second factor you cannot produce, a number you gave up, an address you no longer control.
Check accounts in blast-radius order
An account's risk is what it can reach, so check the accounts that reach the most first. The ranking is roughly the same for everyone, and it decides where an hour of security work is worth the most.
Account risk by blast radius
Account
- Primary email
- Password resets for everything
- Phone number
- Text codes, number lookup
- Password manager
- Every credential at once
- Cloud and backups
- Photos, documents, payments
- Primary social
- Your contacts and voice
- Banking and payment
- Money, directly
What it reaches
- Primary email
- Master key, treated as ordinary
- Phone number
- Routing address, reassignable
- Password manager
- Single point of failure
- Cloud and backups
- Holds the material itself
- Primary social
- Damage lands on others
- Banking and payment
- Best defended, most targeted
Why it sits here
- Primary email
- Phone number
- Password manager
- Cloud and backups
- Primary social
- Banking and payment
| Account | What it reaches | Why it sits here |
|---|---|---|
| Primary email | Password resets for almost everything else | It is the master key, and it is treated as ordinary |
| Phone number | Anything using text codes or number lookup | It is a routing address, and it can be reassigned |
| Password manager | Every credential at once | Single point of both protection and failure |
| Cloud account and backups | Photos, documents, device backups, sometimes payments | Holds the material, not just access to it |
| Primary social account | Your contacts, and your voice to them | The damage lands on other people |
| Banking and payment | Money, directly | Best defended, most targeted |
Everything below that line is ordinary. Spending an hour on the top three is worth more than spending a month on the rest. A sign on a top-row account is therefore urgent, while the same sign on a minor account can wait until you next review it.
Six warning signs, in order of worry
Early means the first sign, not the second. One unfamiliar alert on a quiet account is a reason to read the sign-in list today. Two inside a week, or any change to recovery settings, is a reason to treat the account as already open.
Warning signs by worry level
- 1A code you did not request
- 2Mail or texts that stop arriving
- 3A sign-in alert you cannot place
- 4Contacts receiving messages you did not send
- Recovery details you did not set.The recovery email address or recovery phone number on the account has changed, or a new one was added.
- A forwarding address or filter rule you did not create.Mail is copied out, or filed where you will not see it.
- Two-factor prompts you did not start.Codes or approval requests arrive while you are not signing in.
- A sign-in alert from somewhere unfamiliar.The alert names a device, browser, or city you do not recognize.
- A device or session you do not recognize.The account's device list keeps a session signed in after you sign out.
- A burst of password reset messages, or an app you do not remember granting.Either one means someone has your address and is testing it.
Google's Security page and Microsoft's Recent activity page hold the device list and the sign-in list on one screen. For the last sign, read Google's third-party apps page or Microsoft's apps and services page and remove anything you do not remember granting.
The first three deserve a response tonight. The response order, and what to preserve before you change anything, is in scam reporting and recovery. Assume the account is open and act in order rather than investigating first.
A burst of reset messages is also a reason to think about reuse. CISA's advice on choosing and protecting passwords notes that if attackers guess your password, they would have access to your other accounts with the same password.
Signs that no attacker is involved
Some warnings come before a loss that nobody caused. These are the outcomes people never plan for, and they are worse because there is nobody to appeal to. Check each one against the accounts at the top of the table.
Prevent lockout without an attacker
- Backup codes printed on paper
- Recovery address held for decades
- Current recovery phone number
- Trusted note of what exists
- Legacy contact and inactive-account settings
Risks that have nothing to do with attackers
- The second factor you cannot produce.A phone lost, broken, wiped, or replaced, with an authenticator app that was never backed up and codes that were never printed.
- A phone number you gave up.Changing carrier or country quietly severs the reset route for every account still pointing at the old number.
- An address you no longer control.A work address after leaving the job, a school address after graduating, a domain that expired.
- A service closing your account.Automated enforcement happens, appeals are slow, and if that account is your sign-in for others, the loss spreads.
- Death or incapacity.Everything you have locked down well becomes inaccessible to the people who need it. Apple's legacy contact and Google's Inactive Account Manager exist for this and take about five minutes to set.
- An employer-owned account.Work identities disappear on your last day, along with anything you attached to them.
The fix for the whole category is the same short list: backup codes on paper, a recovery address you will hold for decades, a current recovery number, and a note somewhere trusted about what exists. That takes one afternoon and prevents the class of loss that no support process reliably reverses.
Signs of access you inherited
Access you did not grant is a warning sign in itself. A shared login cannot be revoked for one person, and everyone who has ever had it still has it. A family plan links accounts and sometimes payment methods, and a compromise of the least careful member reaches the rest.
An admin who left with a role nobody removed keeps that role indefinitely. An app you authorized years ago retains its permissions even if the company behind it has since been sold or wound up, and the security of your data is now whoever bought the assets.
The practical control is individual access rather than shared, removal on the day rather than at the next review, and a periodic read through the apps pages named above. That pass sits inside the social media account security audit.
Public details that make a sign more dangerous
Some risks do not involve anyone getting into anything. What is public about you shapes how convincing an attempt against you can be. A birthday, school, home town, pet's name, former handle and employer are each unremarkable alone.
Together they can answer a security question or persuade a support agent. The control is visibility, not secrecy: set the contact list, birthday and location history to a limited audience, and clear the school and employer fields you no longer need. That takes minutes, and it shortens what a stranger can guess.
After the check: the device itself
Set the device up properly from the start, as the new phone privacy checklist sets out. Keeping it current closes a share of what remains. CISA's advice on updating software suggests checking its Known Exploited Vulnerabilities Catalog for software you may be using and prioritizing those updates.
Common questions
Which sign deserves a response tonight?
The first three: recovery details you did not set, a forwarding address or filter rule you did not create, and two-factor prompts you did not start.
Is one unfamiliar alert an emergency?
Not by itself. One unfamiliar alert on a quiet account is a reason to read the sign-in list today. Two inside a week, or any change to recovery settings, is a reason to treat the account as already open.
What if I already suspect something is wrong?
Assume it is and act in order rather than investigating first. The sequence is set out in account security, and doing it unnecessarily costs you twenty minutes.
I have nothing worth stealing. Does this apply to me?
The value of most accounts is access to other people. A trusted account with real contacts is useful to somebody regardless of what is inside it.
