It usually starts with something small. A login attempt you didn’t make. A password reset email you didn’t request. Or…