When a CRM account is taken over, the attacker usually doesn’t announce it. They log in with a stolen password or a session token, look around, and take what is valuable. Your best chance of catching it is to notice behaviour that doesn’t fit the person, because the login itself looks legitimate.

Think in terms of “unusual for this user”

Rules like “alert on any failed login” generate noise you’ll learn to ignore. A more useful question is: what would this particular person normally do? A sales rep logs in during working hours from a handful of places, works on their own accounts, runs a few reports, and rarely touches settings. Deviation from that pattern is the signal.

You do not need specialist tooling to start. The sign-in history and audit trail in most CRMs show enough to build a picture, and many platforms offer built-in alerts. Check the vendor’s current documentation for what yours records and how long it keeps it.

Sign-in signals

• Logins from a country or network the user has never used, especially if shortly after a login from their usual place
• Sign-ins at hours that don’t match the person’s role or time zone
• A burst of failed attempts followed by a success, which suggests password guessing or reuse of leaked credentials
• Repeated multi-factor prompts the user didn’t initiate, sometimes called prompt bombing, followed by an approval
• A new device or browser appearing without a reason
• Sessions that remain active in two distant places at once

None of these proves anything alone. People travel, use VPNs and change phones. Treat them as reasons to look further.

Activity signals

What the account does after login tells you more:

• Bulk exports or downloads of contacts, accounts or reports that the user rarely runs
• Searches that sweep widely, such as listing every customer rather than the user’s own
• Changes to settings: new connected apps, new API tokens, altered email forwarding, modified notification rules
• Changes to the user’s own security settings, such as a new MFA device or a recovery email
• Creation of new users or elevation of permissions
• Mass edits or deletions that could hide tracks

A common trap is watching only for data theft. Attackers who want persistence often create an API token or connected app first, because it keeps working even after the password is reset.

Confirm quickly and quietly

When something looks off, resist the urge to email the user from the CRM or to confront them in a public channel. Contact them by a separate channel, such as a phone call to a known number, and ask simple questions: were you travelling, did you approve a prompt, did you export a report today? Their answer often resolves it in minutes. If they weren’t, you have a probable compromise.

First containment steps

Act in an order that stops access while keeping evidence:

1. End the user’s active sessions and block sign-in.
2. Force a password reset through a trusted route, and re-register MFA from scratch after verifying identity.
3. Revoke API tokens, connected apps and any recent authorisations created by the account.
4. Preserve the sign-in and audit logs for the period in question before anything rolls off.
5. Review what the account accessed or changed, and reverse unauthorised changes.
6. Look for the same pattern on other accounts, since attackers often reuse one phishing campaign or leaked credential list.
7. Escalate to your incident process if personal data may have been exposed, so notification duties can be assessed. Those duties vary by jurisdiction.

Signals and responses

Signal	Possible explanation	Quick check
Login from a new country	Travel, VPN or takeover	Contact the user by phone
Many failed logins then success	Password guessing or leaked credentials	Check the source address and reset the password
Unrequested MFA prompts	Attacker has the password	Block sign-in, review approvals
Large export out of pattern	Data theft or a legitimate project	Ask the user and their manager
New API token or connected app	Persistence mechanism	Revoke and trace creation
Changed forwarding or notification rules	Covert data diversion	Inspect and remove

A hypothetical example

Imagine an account executive who normally works from one city. The admin sees a successful sign-in from an unfamiliar location at an odd hour, followed within minutes by a full export of the contact list and the creation of a new API token. The admin phones the executive, who confirms they were asleep and never approved anything. Sessions are ended, the token is revoked, the password and MFA are reset, and the logs are saved. The review shows the export contained contact names and emails only, which informs the incident team’s assessment. Because the admin noticed the token, the attacker lost the persistent access they had set up.

Frequently Asked Questions

Is multi-factor authentication enough to prevent account takeover? It makes it much harder, but not impossible. Attackers use stolen session tokens, prompt fatigue and social engineering. Monitoring still matters.

How long do CRM logs usually go back? It varies by vendor and plan. Check the current documentation, and export or forward logs somewhere with longer retention if your platform’s window is short.

Should we force password resets for everyone after one compromise? Not automatically. Start by working out how the account was compromised. If a credential leak or phishing campaign affected others, a wider reset is reasonable.

Can we automate any of this? Yes. Alerts for new locations, bulk exports and new tokens are common starting points. Tune them so they trigger on meaningful events rather than every minor variation.

What if the user denies doing anything but the evidence says otherwise? Handle it as a process question, not an accusation. Preserve evidence, involve HR or your insider-risk process where appropriate, and avoid drawing conclusions before the logs are reviewed.

Next Step

Open your CRM’s sign-in history and audit log for one active user this week and write down what a normal week looks like. Once you can describe normal, you can start defining the alerts for what isn’t.