Unauthorized access and control of an online account, often through stolen credentials, phishing, SIM swapping, or malware. Investigations may focus on login IPs, device fingerprints, password reset events, MFA changes, and victim/provider communications.
