Review account activity and logins

I’m checking for suspicious access. Review recent account activity for claire@lumenphoto.com and list every login in the last 60 days with date, time, approximate location, device type, and IP. Flag any sessions marked active now and give a simple recommendation for each flagged item: keep, log out remotely, or investigate further.

Before I escalate anything to legal, make the activity log easy to scan: put potential anomalies up top, explain why each looks suspicious in one sentence, and point to evidence that would confirm or clear it. If a login looks like a travel-related change, say whether it matches our staff calendar or requires a password reset.

I checked account activity and found a login from Warsaw at 03:12 UTC two nights ago. We have no team members or planned travel there. I don’t know whether the location is a false positive, a VPN artifact, or an attacker. I’m afraid to log everyone out and interrupt a scheduled campaign. What’s the most likely cause and the next action that balances security with not blowing up the campaign?

This keeps happening during paid campaigns: unexpected logins force emergency password changes and paused ads. Where are we losing control — poor credential hygiene, shared passwords, or incomplete device records — and what one policy change and one simple tool will prevent these mid-campaign disruptions going forward?