Identify the basic facts
Look for the timestamp and time zone, account, device, action, and result. A failed sign-in differs from a successful one. An unfamiliar location can be a clue, but network routing, travel, and VPN use can make location estimates misleading.
Build a short timeline
Consider a fictional record showing several failed sign-ins followed by a successful sign-in. Ask whether the person recognizes the successful session and whether a known device was used. Keep observations separate from conclusions: 'five failures occurred' is a fact; 'the account was stolen' needs more evidence.
Respond through trusted controls
Open the account's official security page rather than following an alert email's link. Review sessions and account changes. For workplace systems, report your observations rather than making disruptive changes outside your authority.
- Record times with their time zone.
- Avoid sharing logs that contain private details or secrets.
- Distinguish what happened from what you suspect happened.