Identifying accounts having shared credentials

A non-transitory computer readable medium including one or more sequences of instructions that, when executed by one or more processors, causes the one or more processors to perform operations comprising:

• obtaining, by a content management system, login context data from a user device, the login context data corresponding to an attempt to log in to a user account managed by the content management system;
• creating, by the content management system, a fingerprint for the user device;
• updating, by the content management system, a historical login context data repository based on the login context data, the historical login context data repository including historical login context data corresponding to a plurality of login attempts associated with the user account;
• generating, by the content management system, a plurality of login metric values using a plurality of login metrics and the fingerprint associated with the user device based on the historical login context data for the user account stored in the historical login context data repository;
• determining, by the content management system, that the user account is being shared among multiple users based on the plurality of login metrics;
• and
• in response to a determination that the user account is being shared among multiple users, initiating remedial action for the user account.

A content management system comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium including one or more sequences of instructions that, when executed by the one or more processors, causes the content management system to:
• obtain a historical login context data repository including historical login context data of a user device corresponding to a plurality of logins associated with a user account;
• create, by the content management system, a fingerprint for the user device;
• and
• detect whether the user account is being shared among multiple users, wherein detecting whether the user account is being shared among the multiple users comprises:
• generating a login metric value using a login metric based on the historical login context data for the user account and the fingerprint of the user device associated with the user account that are stored in the historical login context data repository,
• determining the user account is being shared among the multiple users based on the login metric value, and
• initiating remedial action for the user account when the user account is being shared among the multiple users.