Spartans,

When an online account is compromised, it can be both frustrating and scary, but identifying it early can help minimize the impact. Here are a few examples of suspicious account activity you should watch out for along with actions to take. 

• Changes to password and/or account settings: If you detect changes to your account password or account settings which you did not make, it may indicate that your account has been compromised. If needed, initiate account recovery. Change your password, then update your account settings.
• Posts you didn’t write appear on social media: If you notice posts on your social media wall which you did not create, it is an indication that someone may have gained access to your account. Delete the posts and change your password. Enable Two-Factor Authentication, which most social media sites support. 
• Unusual email activity: If you see messages in your “Sent” folder that you didn’t send, you have new contacts that you don’t know, or if it seems like you are missing emails, your email account may be hacked. Change your password immediately, ensure two-factor authentication is enabled, and check your account settings to ensure  email forwarding has not been enabled (which would automatically send your email to a bad actor). Consider reporting unknown email addresses found, if email forwarding is enabled 
• Charges/purchases you do not recognize: If your online purchase history or credit card statement displays charges or purchases you do not recognize, contact your financial institution, and change your password if necessary.  Ensure Two-Factor authentication is enabled. 
• Logins from unknown devices/locations: Most accounts, including streaming accounts, allow you to view which devices are logged into your account and where they are located. If you see a login from an unknown device or location, log that device out and change your password.  Enable Two-Factor Authentication where possible. 

If you think your @sjsu.edu account may have been compromised, email the Information Security team at security@sjsu.edu right away. Remember, SJSU will never send unsolicited messages asking for your password or other personal information.

Thank you Noel McCormick and Cole Gunter from Information Security for providing these tips. As always, the SJSU IT Service Desk is here to help by phone at (408) 924-1530 or online.

Thanks,
Bob Lim
Vice President for Information Technology
and CIO at San José State University