ojava
Start free trial

All guides

Someone is guessing a password

What happened

Many wrong passwords were tried on one account in a short time. As long as 2-step verification is on, the account is usually safe; a weak or reused password makes it urgent.

How serious

Serious: deal with it today.

Steps: Microsoft 365

  1. Check their 2-step methods: Microsoft Entra admin center → Users → the person → Authentication methods. Delete any phone or app they don't recognise.

    Open the page: entra.microsoft.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  2. Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.microsoft.com/#/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Look at their recent sign-ins: Microsoft Entra admin center → Users → the person → Sign-in logs. Note countries and devices they don't recognise.

    Open the page: entra.microsoft.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Steps: Google Workspace

  1. Check their 2-step settings: user page → Security → 2-step verification and Recovery information. Remove phones or keys they don't recognise.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  2. Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Look at their recent sign-ins: Google Admin console → Reporting → Audit and investigation → User log events, filtered on the person.

    Open the page: admin.google.com/ac/reporting/audit/user_accounts
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

How to check it’s fixed

Fixed when the person confirms the activity, or when the password is new, all sessions are signed out and no unknown method, rule or app is left. Ojava raises no new alert for them.

When to call your IT provider

Call your IT provider now if the person didn't do this, or if you are unsure.