I’m trying to improve my privacy and security after noticing suspicious login attempts on one of my accounts. I need help creating a personal threat model to identify likely risks, assess vulnerabilities, and prioritize practical security measures.
Don’t start by installing a pile of security tools or assuming someone is specifically targeting you. Suspicious login attempts are often automated credential-stuffing attacks using passwords leaked from another service. Treat the incident seriously, but prioritize likely risks before rare, advanced threats.
First, contain the immediate problem. Change the affected password from a device you trust, make it unique, sign out other sessions, and enable strong two-factor authentication. An authenticator app or security key is better than text messages when available. Check the account’s recovery email, phone number, forwarding rules, connected apps, and recent activity. If that password was reused anywhere else, replace it there too. Save the new passwords in a reputable password manager rather than trying to memorize variations.
Then write a simple threat model around four questions:
- What are you protecting? Email, banking, cloud files, private messages, identity documents, work access, and social accounts.
- Who might realistically want access? Usually automated attackers, scammers, an abusive acquaintance, or someone with physical access to your devices.
- How could they get in? Reused passwords, phishing, weak recovery questions, an exposed email account, malicious browser extensions, outdated devices, or an unlocked phone.
- What would hurt most? Financial loss, identity theft, private information being exposed, account impersonation, or losing access completely.
Rank each risk by likelihood and damage. For most people, email deserves the highest priority because it can reset nearly every other account. After that, secure financial accounts, your phone carrier account, password manager, cloud storage, and major social accounts. Keep recovery codes somewhere offline, turn on login alerts, update devices automatically, and remove apps or extensions you no longer use.
The commonly missed part is recovery. Strong passwords and 2FA will not help much if an attacker can take over your recovery email or persuade your carrier to move your phone number. Review those paths as carefully as the main login. Your threat model does not need to predict every possible attack. It just needs to identify the few failures that would cause the most damage, then reduce those risks with steps you can realistically maintain.
Don’t click the link in the login alert. Open the app or type the site address yourself, then check the account’s actual activity page. Fake security notices are a common way to turn a harmless automated attempt into a successful phishing attack.
@apiapi4 covered account priority well, but I’d model access paths rather than making a huge inventory of possible attackers. Pick each critical account and trace how someone could reach it: password reset through email, approval notification on your phone, recovery through your carrier, an already-authorized device, or a connected third-party app. That exposes weak links quickly. Your bank password may be excellent while your email recovery or mobile account is still easy to take over.
Run a small recovery drill too. Confirm that backup codes are readable, recovery addresses still belong to you, and you can regain access if your phone disappears. Record the date, what you changed, and any unfamiliar sessions or messages. A useful threat model is a short working document you revisit after a new device, account breach, move, breakup, or job change, not a security checklist you complete once and forget.
Write down the three accounts whose loss would cause the most damage, then rank each by impact and likelihood. Email usually sits at the top because it can reset everything else. For each account, note what an intruder could gain, how they might get in, and which single change would reduce the risk most. That keeps the exercise manageable instead of turning it into a catalog of every possible threat.
I would not assume suspicious login attempts mean someone specifically targeted you. They are often automated credential-stuffing attempts using passwords from old breaches. Still, treat them as evidence that your login address is known: replace any reused password, enable strong MFA, revoke unknown sessions, and check whether account details or forwarding rules changed.
The missing piece in many threat models is blast radius. @apiapi4 is right to examine recovery paths, but consider what the accounts contain too. Delete old sensitive messages, remove unnecessary connected apps, avoid saving payment details where you do not need them, and separate critical accounts from throwaway signups. Preventing access matters, but leaving less valuable material behind can make a successful compromise far less damaging.
A failed login from another country and a successful login from your own city are very different cases, even if the alerts look equally alarming. Check the account’s real activity page and establish whether access actually occurred. IP location, device names, and “new device” labels are clues, not proof.
Build response triggers into the threat model. For example: isolated failed login means monitor; repeated MFA prompts mean change credentials and review recovery methods; an unknown successful session means revoke access and inspect the account; several affected accounts means check the device and primary email.
The three-account approach from @byteloop5388sync is sensible, but avoid elaborate numerical scoring. “Likely, damaging, cheap to fix” is enough to put a risk near the top. Fake precision usually produces a nice spreadsheet and no action.
Keep the original alerts and note times, accounts, and changes. If attempts start using personal information, follow you across new addresses, or coincide with offline harassment, stop treating them as routine credential stuffing. That is a different threat model.
If anyone else can unlock your phone or uses the same computer profile, the answer changes. Account security alone will not fix a local access problem. Change device PINs, create separate computer accounts, stop sharing browser profiles, and check which browsers and devices are syncing passwords, email, and notifications.
@codeminer9255’s access-path approach is useful, but include every place a secret can appear. A login code might show on the lock screen. A password reset may arrive in an email app that stays signed in. A supposedly deleted file may still exist in cloud sync or backups. For each important account, note where credentials, reset messages, and active sessions are stored.
Pick controls based on the easiest realistic route, not the most technical attack you can imagine. If somebody can read your unlocked phone, buying a security key while leaving notification previews visible misses the problem. If nobody has physical access and all attempts are unsuccessful, unique passwords, MFA, and session cleanup are probably the right level of response.
After making changes, watch whether the pattern stops. Another successful login after changing credentials from a trusted, updated device suggests you missed an active session, recovery route, connected app, or compromised endpoint. That feedback loop is part of the threat model: make a change, define what failure would look like, then know what you will investigate next.
A shared computer at home is a very different problem than a laptop only you touch, and @joe39 nailed the part everyone else glossed over. All the recovery-path mapping in the world won’t help if your reset emails pop up as lock screen previews on a phone your roommate can grab.
A threat model is not the same as a security checklist. If you cannot state what evidence supports a threat, it is easy to spend weeks defending against a guessed attacker while overlooking ordinary account abuse.
I’d keep an “observed” column separate from an “assumed” column. “Three failed logins appeared in the account’s activity page” is observed. “Someone knows my password” is only an assumption unless the service says the password was accepted or an unknown session succeeded. @beacon.dev’s response triggers make more sense when tied to evidence this way. For each observation, record what would confirm escalation and what action you would take.
Include the risk of locking yourself out, too. A security change can reduce account theft while increasing your dependence on one phone, key, or recovery address. Before tightening access, decide what happens if that item is lost, stolen, or unavailable. The best priority is usually the control that reduces a likely attack without creating a single failure point you cannot recover from.
If the account holds data you no longer need, reduce the risk before adding more defenses: download anything important, delete old messages and files, then empty trash and review retained backups. Your threat model gets much simpler when a breach exposes less.