How to use your wallet activity log to spot unauthorised access

A wallet activity log is one of the clearest records of what has happened inside an online account. It can show sign-ins, failed password attempts, new devices, approximate locations and security changes that are easy to miss in a busy inbox. Reviewing these details regularly helps separate normal activity from warning signs of account takeover.

SAWANVEGAS Wallet runs in a modern web browser, so account access depends on the browser session, JavaScript and the security of the device being used. There is no separate software installation to check. That makes the activity log especially useful: it provides a central place to examine access patterns when a login notice, unfamiliar transaction or unexpected account change appears.

Find the activity record before investigating

Open the wallet through the official website and sign in using a trusted browser. Avoid following a login link from an email, social media message or text until its destination has been verified. A genuine-looking message can lead to a fake page designed to capture your username, password or one-time security code.

Look for a menu labelled activity, security, login history, sessions or account access. The exact wording can vary as the interface changes, and JavaScript must be enabled for the wallet interface to load and operate correctly. If the page appears incomplete, refresh it in an up-to-date browser rather than entering credentials into a page that behaves unusually.

Record the date, time, device type, browser and approximate location shown for each event. Screenshots can preserve evidence before entries expire. Do not share screenshots publicly if they display an email address, wallet identifier, session token or other private information.

Learn what normal access looks like

A useful review begins with your own routine. You might usually sign in from a laptop in Melbourne during the evening, use a phone while commuting in Brisbane, or access the account from a home connection in Perth. Those patterns create a baseline against which unfamiliar events can be judged.

An IP address does not identify a person precisely. Mobile networks, corporate connections and privacy services can make a familiar device appear in another suburb or city. A location several hundred kilometres away is more concerning when it occurs minutes after a legitimate session, but a single location mismatch is not conclusive evidence by itself.

Keep in mind that Australian daylight saving affects displayed times in some states but not others. Compare the log with your local time zone, calendar and device history. An event recorded at an unexpected hour may simply reflect UTC, a server location or a browser session that remained open overnight.

Separate failed attempts from successful logins

Repeated failed password attempts suggest that someone may be testing stolen or guessed credentials. They become more serious when followed by a successful sign-in, a password reset, a new device registration or a change to contact details. A successful login from an unfamiliar browser deserves prompt attention even if no funds have moved.

Look for clusters rather than isolated entries. Five failed attempts from different countries, followed by a successful sign-in from a new device, indicate a different level of risk from one failed attempt caused by a mistyped password. Rapid changes to password, recovery email, two-factor authentication or withdrawal settings are particularly important signals.

Do not assume an unfamiliar browser always means a stranger. Clearing cookies, updating a browser or using a private window can create a new session label. The strongest warning signs are combinations: unfamiliar device, unusual time, new location and account changes that you did not make.

Check devices, sessions and account changes

Review active sessions and revoke any that you cannot identify. If the wallet offers a “sign out everywhere” function, use it after suspicious access. This closes lingering browser sessions on shared computers, old phones and devices that may have been lost or sold.

Change the wallet password from the official account page, using a long and unique password that is not reused for email, banking or shopping accounts. Secure the email account connected to the wallet as well, because an attacker who controls that inbox may intercept password-reset messages.

Enable available multi-factor authentication and confirm that recovery details are correct. A code delivered through an authenticator app may provide stronger protection than an SMS code, particularly where mobile-number porting is a concern. Never disclose a verification code to a person claiming to be support.

Connect log entries with financial activity

An unauthorised login does not always result in an immediate transfer. An intruder may first inspect balances, add a trusted device, alter contact information or wait before attempting a withdrawal. Compare the access record with wallet movements, recipient addresses and any changes to transaction limits.

Treat unexpected account messages as evidence to verify, not instructions to follow. A fraudster may send an urgent warning that your wallet is locked and then direct you to a counterfeit sign-in page. Financial pressure can also be used to distract victims; an online loan guide may help explain why borrowing-related messages should be checked independently before any payment or application.

For Australian users, unusual activity should be considered alongside familiar scam patterns reported by banks and government agencies. Messages that ask for an upfront “release fee”, remote access to your computer or a transfer to a personal account are major warning signs. Legitimate assistance should be reached through the wallet’s own contact access, not a phone number supplied in a suspicious message.

Respond quickly and preserve useful evidence

If the log indicates unauthorised access, stop using the affected session and secure the account from a separate trusted device. Change the password, revoke sessions, enable multi-factor authentication and review recovery details. If transactions are involved, record their references, times, amounts and destination details before contacting the relevant support channel.

Preserve the original emails, message headers, screenshots and browser notifications. Do not edit images in a way that removes timestamps or technical details. Write down what happened in sequence, including when you first noticed the event and which security actions you took.

Australian consumers can also contact their bank immediately if linked payment details may be exposed. Scam activity can be reported to Scamwatch, while suspected identity misuse may require advice from IDCARE. If personal information has been compromised, the Privacy Act 1988 and the Notifiable Data Breaches scheme may be relevant, depending on the organisation and type of data involved.

Build a practical review habit

A short weekly check is usually enough for an active wallet, with an additional review after travelling, using a public computer or connecting through unfamiliar Wi-Fi. Airports, hotel networks and cafés in Sydney, Adelaide and other Australian cities can be convenient, but shared networks increase the importance of logging out and avoiding saved passwords.

Use a private device profile for financial accounts, keep the operating system and browser patched, and remove extensions that you do not recognise. JavaScript-enabled wallet pages should be loaded only from the correct domain, because malicious browser extensions or lookalike pages can alter what appears on screen.

Keep a simple record of recognised devices and normal access locations. When an alert arrives, compare it with that record instead of reacting to a headline such as “new login” alone. A consistent process makes it easier to identify genuine account compromise while avoiding unnecessary panic over ordinary mobile-network or time-zone variations.

Understand when the log is not enough

An activity log can show that an account was accessed, but it may not reveal how the credentials were obtained or whether a device itself is infected. If suspicious events continue after a password change, scan the device, remove unknown extensions and use a different trusted device for recovery.

Contact wallet support through the built-in or official contact route when entries cannot be explained, sessions cannot be revoked or a transaction appears unauthorised. Give support the relevant timestamps, device information and transaction references, while withholding passwords and authentication codes. A legitimate support representative should not need those secrets.

Reviewing access history is most effective when combined with strong passwords, multi-factor authentication, secure email and careful verification of messages. The log turns vague concern into a timeline, allowing you to identify unusual behaviour, contain the account and provide clearer information to the people responsible for investigating it.