A computer-implemented method of identifying unauthorized attempts to access an account in a computer system, the account having an authorized user, the method comprising: determining that a count of failed attempts to access the account exceeds a maximum; based on the count exceeding the maximum, retrieving from stored user data one or more peer contacts associated with the authorized user; transmitting a failure attribution request to the one or more peer contacts; receiving a response from at least one of the one or more peer contacts; when the response denies that the authorized user caused the failed attempts, taking a security action with respect to the account; the method characterized by, either: transmitting the failure attribution request to a user contact address for the authorized user, receiving a response from the user contact address, and when the response denies user involvement in the failed attempts then taking the security action; or wherein the one or more peer contacts comprise a plurality of peer contacts in a hierarchical order, and wherein transmitting comprises: transmitting the failure attribution request to a first peer contact in the hierarchical order; awaiting the response; and if the response is not received within a time window, sending the failure attribution request to a next peer contact in the hierarchical order. determining that a count of failed attempts to access the account exceeds a maximum; based on the count exceeding the maximum, retrieving from stored user data one or more peer contacts associated with the authorized user; transmitting a failure attribution request to the one or more peer contacts; receiving a response from at least one of the one or more peer contacts; when the response denies that the authorized user caused the failed attempts, taking a security action with respect to the account; the method characterized by, either: transmitting the failure attribution request to a user contact address for the authorized user, receiving a response from the user contact address, and when the response denies user involvement in the failed attempts then taking the security action; or wherein the one or more peer contacts comprise a plurality of peer contacts in a hierarchical order, and wherein transmitting comprises: transmitting the failure attribution request to a first peer contact in the hierarchical order; awaiting the response; and if the response is not received within a time window, sending the failure attribution request to a next peer contact in the hierarchical order. transmitting the failure attribution request to a user contact address for the authorized user, receiving a response from the user contact address, and when the response denies user involvement in the failed attempts then taking the security action; or wherein the one or more peer contacts comprise a plurality of peer contacts in a hierarchical order, and wherein transmitting comprises: transmitting the failure attribution request to a first peer contact in the hierarchical order; awaiting the response; and if the response is not received within a time window, sending the failure attribution request to a next peer contact in the hierarchical order. transmitting the failure attribution request to a first peer contact in the hierarchical order; awaiting the response; and if the response is not received within a time window, sending the failure attribution request to a next peer contact in the hierarchical order.