Recognizing the Signs of a Compromise — Cybersecurity Basics: Protect Yourself and Understand the Threats

Despite all your precautions, there may come a day when an account or a device is no longer fully yours. The sooner you notice, the less it costs you. In this lesson you will learn the warning signs of a compromised account and a compromised device, how to tell a real alert from a false one, and how to run a calm check before deciding what to do.

You have spent six chapters building defenses. This final chapter assumes that something might get through, and prepares you to respond with a clear head. Nothing in it is meant to scare you; it is meant to make sure that, on the day it matters, you are not improvising.

A compromise is often silent

People expect an attack to be spectacular: a red screen, a ransom note, a skull. Sometimes it is, as with ransomware. But many compromises are quiet, because the attacker wants to stay unnoticed for as long as possible, to read your emails, steal data, use your accounts or wait for a profitable moment. So the signs are often small and easy to dismiss. Learning to read them is a skill.

No single sign proves a compromise. A slow computer may just be old. The right approach is to look for patterns and to verify, calmly, using the checks below.

Signs that an account is compromised

Unexpected sign-in alerts: messages saying that your account was accessed from a new device or an unusual place, which you did not do. Beware that fake alerts exist too, so verify by opening the service yourself.
Password or recovery changes you did not make: you receive a notification that your password, phone number or recovery email changed.
Unrequested verification codes or approval requests: codes arriving by text message or app that you did not ask for mean someone is trying to sign in with your password.
You are suddenly locked out though you typed the right password.
Messages or posts you did not write: contacts tell you that they received strange messages, links or requests for money from you.
Sent mail you do not recognize, or emails disappearing from your inbox, or new forwarding rules and filters in the settings.
Unfamiliar devices or sessions in the "active sessions" or "devices" page of the account.
Changed settings: new connected apps, changed profile details, unknown payment methods or addresses added.
Unexpected purchases, orders or transfers, or notifications from your bank about operations you do not recognize.
Password reset emails you did not request, arriving in numbers. Someone may be trying to take over an account.
Your address appearing in a data breach, which tells you that the password for that service must be changed, and anywhere else it was reused.

Signs that a device is compromised

Unusual slowness, heat or battery drain without a clear reason, and a fan that never stops.
Unfamiliar programs, extensions or apps, or settings that changed: a new browser home page, a different search engine, unknown toolbars.
Pop-ups and redirections: advertising where there was none, or web pages that redirect to strange sites.
Security tools switched off, or an antivirus that cannot update, and that you did not disable.
Files renamed, missing or unreadable, or a message demanding payment, which indicates ransomware.
High mobile data use or network activity without a clear cause.
The camera light or microphone indicator turning on unexpectedly.
On a phone: apps you did not install, permissions you never granted, a device administrator or accessibility service that you do not recognize, text messages sent or premium services subscribed to without your knowledge.
Strange behavior: the mouse moving by itself, windows opening and closing, programs that crash repeatedly.
Your contacts report strange messages coming from your address or number.

Signs that your identity or data is being misused

You receive bills, debt collection letters or credit refusals for things you did not do.
You get notifications for accounts or services you never created.
You see messages from organizations that claim to have been breached and hold your data.
Strangers contact you with detailed personal information to make you believe they are legitimate, such as in a targeted scam call.
You discover a fake profile using your name and photos.

False alarms and fake alerts

Attackers know that you are worried about security, and they use it. Be careful with:

An email claiming that "someone signed in to your account", with a button to "secure your account". It may itself be phishing. Open the service directly, outside of the message.
A pop-up in your browser saying that your device is infected, with a number to call or a program to download (lesson 1.3).
A call from "your bank's fraud department" asking you to move money to a "safe account", or to read out a code. Real banks do not ask for this.
Messages from supposed "hackers" who claim to have your password and a compromising video, and demand cryptocurrency. They often quote an old password taken from a past breach, as proof. This does not mean that they control your device, and it is a widely used extortion scam. Change the password if it is still in use, and do not pay.

A calm check: five questions

When something seems off, work through these questions before deciding what to do:

What exactly did I see? Write down the facts and the time.
Is the alert real? Verify through the official app, or by typing the address, never through the message that alarmed you.
Which accounts and devices might be affected? Think of the account itself, and of every account that shares its password or its recovery email.
What could the attacker do with this access? Think of what sits in the account: contacts, payment cards, documents, other accounts that it can reset.
How urgent is it? Money at stake or an active takeover means acting now; a possible old leak allows a methodical cleanup.

Useful checks you can do yourself

Account activity pages: most services show recent sign-ins, devices and locations. Look for entries you do not recognize.
Email settings: forwarding addresses, filters, signature changes, connected apps and delegated access.
Security tool scan: run a full scan with your up-to-date security tool.
Installed programs and extensions: remove those that you do not know or no longer use.
Phone checks: the list of apps, device administrators, accessibility services, battery and data usage per app, and the configuration profiles.
Bank and card statements: look at recent transactions, including very small ones, which attackers sometimes use to test a card.
Breach notification services: check whether your addresses appear in known leaks.

Tip: set up alerts for your most important accounts: sign-in notifications for email and banking, and transaction notifications for your cards. They turn silent compromises into noisy ones, which is what you want.

If you are not sure

It is better to act on a suspicion than to wait for proof. Changing a password costs a few minutes; a missed takeover can cost much more. The French platform cybermalveillance.gouv.fr offers a free online diagnostic tool that guides you through the situation, and you will find a similar service in many countries. In a work context, report to your security contact, as seen in lesson 6.4.

Your turn

Exercise. Read the three situations and decide which is most likely a real compromise, which is probably a scam, and which can be a harmless explanation. Justify each.

An email says "Your account has been hacked, click to secure it within 1 hour".
Three friends tell you they received a message from you with a strange link, but you did not send it.
Your five-year-old laptop is slow on the day you open fifty browser tabs.

See a solution

Probably phishing: urgency, a link, and an alarm of the type attackers use to get you to act. Check by opening the service directly, not through the link.
Likely a real compromise of your account or device, since the messages came from you in a way you did not control. Treat it as urgent: it is the cue for the response steps in the next lesson.
Probably harmless: an old machine under heavy load. Still, close the tabs and see whether the symptoms disappear; run a scan if they persist.

Add to your Security Notebook

Create the heading "7. Incident response". Write the five signs you consider most important to check for, and decide which alerts you will turn on this week (sign-in alerts for email, banking and card transaction notifications).

Key takeaways

Many compromises are silent; look for patterns such as unexpected alerts, changed settings, strange messages sent in your name or unfamiliar apps and sessions.
Fake alerts and extortion emails exploit your worry; always verify through the official app or address, not through the message.
Use a calm check: what did I see, is the alert real, what is affected, what could an attacker do, and how urgent is it?
Turn on sign-in and transaction alerts, and act on a suspicion rather than waiting for proof.

Now suppose the check confirms that something is wrong. The next lesson gives you the concrete, ordered steps to take.