How to Investigate a Suspicious Change to a Business User’s MFA Methods

An unexpected MFA method change may reflect legitimate device replacement or an attacker weakening account protection.

Checks to make

Preserve identity audit events, verify the user through a trusted channel, review recent sign-ins and recovery changes, and confirm the new factor owner. Revoke suspicious sessions and restore approved factors under the incident process.

When to get help

Incident response can investigate identity changes and account security. Informatix Systems can assess the symptoms, evidence, and next steps. Contact Informatix Systems to discuss this issue.