How to deal with an account that may be compromised?

Question

Hypothetical situation: An established user on the site that I'm moderating suddenly starts acting strange. The user begins doing something that he wouldn't normally do, i.e. loudly protesting against certain decisions, posting rambling semi-on-topic comments on random posts, etc. I'm starting to think that maybe someone took control of this account, and it may be compromised.

What should I do in this case? The problem is that I'm not sure what happened; I can't tell whether someone found the account's password or if that user simply had a sudden change in character. Maybe the change was very minor; for example, maybe he starting promoting a certain website. I can't tell whether someone from that website has taken control of his account, or if he just suddenly really likes that website.

How can a situation like this be handled?

Answer 1

If it's a stark behavioral change, or the account is suddenly being used to post outright spam, I would suspend it with a "we think this account is comprimised, we're working on confirming it's still you" message. If rules are being broken, you might just suspend with the reason being the rule-breaking.

If I can see it, I would check their email address and send them an email asking if they're still in control of the account. It's possible that both accounts were compromised, but less likely.

Also, compare activity. Is the user suddenly sleeping when they used to be awake and posting things? Are they posting things when they used to be sleeping? If you have access to it, have they changed their password recently?

This is mostly just me typing everything that comes to mind, of course.

Answer 2

The first course of action should be to limit the potential damage to your community. Reach out to the user using another method of communication. In that communication, mention the concerns you have and explain that you've suspended the account for the time being just to verify that the account is not compromised.

One thing to be cognizant of though: If the user's account has been compromised in your community there is a high likelihood that other aspects may be compromised too. This includes however you sent the concerned communication from above.

This is a time to reach out to community members that may know the owner of the affected account and see if they can reach the owner. This is especially helpful if another member knows the person off line.

---

At this point you've suspended the user and made your best attempt to contact them. Now what? Now you see what damage they have done to your community before the suspension. If it was spam postings, those need to be cleaned up. If it was off topic ramblings, those need to be cleaned as well.

Did the user have access to other features? Were they a moderator? If so, you need to check logs to ensure that no funny business occurred there either. Reverse it if needed.

You may have to accept that the user has been compromised. In that case, you've lost a contributor. Hopefully, however, they return under another account. Unfortunately, compromises occur.

Alternatively, the user may not have been compromised, but instead had a change in their life. Stress in the world could spill over to their online activities. In this case, you reaching out to them may be a good way for them to come back to the group as a valid contributor.