Password Change Event

The password_change event type is used when a user changes their password from inside the account (authenticated context). A password change following an unusual sign-in is a strong account-takeover indicator; a burst of password changes across accounts can signal a credential-stuffing cleanup wave.

Not for password resets

Password changes made through a forgot-password flow (unauthenticated) are a different signal — agree the event type and mapping for that flow with Mubeen before wiring it.

Category: Non-monetary Relevant feedback outcomes: success, fail, fraud, rejected

Request Example

POST /api/v1/generic/validate HTTP/1.1
Host: api.sa.mubeen.ai
X-API-Key: ***
Content-Type: application/json

{
  "event_type": "password_change",
  "timestamp": "2025-03-15T19:30:00Z",
  "attempt_id": "att_pwdchg_7742",
  "external_id": "change_998879",
  "device_id": "fp_acctchg_mno34567",
  "user_id": "usr_890123",
  "user_email": "[email protected]",
  "full_name": "Layla Mahmoud",
  "ip_address": "178.22.91.55",
  "ip_country": "SA",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0",
  "channel": "web",
  "platform": "web",
  "account_created_at": "2022-08-01T00:00:00Z"
}

Response Example

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234569",
  "decision": "log",
  "risk_score": 8,
  "risk_level": "low"
}

Feedback Examples

Successful Password Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234569",
  "outcome": "success",
  "external_id": "change_998879"
}

Fraudulent Password Change (Takeover Lock-In)

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234569",
  "outcome": "fraud",
  "outcome_details": {
    "fraud_type": "account_takeover",
    "detection_method": "user_reported"
  },
  "external_id": "change_998879"
}

Failed Password Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234569",
  "outcome": "fail",
  "external_id": "change_998879"
}

Key Fields for Password Change Events

Field	Importance	Notes
user_id	Required	Identifies the account being modified
device_id	Recommended	Changes from a new device are higher risk
ip_address	Recommended	Changes from an unusual IP indicate potential compromise