1. A method comprising: determining, by a server computer for a client device, a first identifier associated with the client device; analyzing, by the server computer, an activity log associated with an account of a user to determine if an eavesdropping condition has been met during a given duration, the analysis comprising: determining that an eavesdropping activity has occurred during the given duration and determining that no normal activity has occurred during the given duration for the first identifier; determining a second identifier associated with a second device used to access the user account; and determining that a normal activity associated with the second identifier has occurred during the given duration; and when the eavesdropping condition has been met, marking, by the server computer, the account as compromised; communicating, by the server computer, a result of the analysis.