A compromised peer review account reveals itself through a combination of unauthorized activity, unusual behavioral patterns, and unexplained changes to your profile and credentials. The most obvious red flag is discovering reviews you did not write published under your name—a researcher at a major university found six peer review reports in her email notifications for papers she had never seen, with detailed technical feedback written in a style completely unlike her own. Other critical signs include login alerts from unfamiliar locations, changes to your password or associated email address that you did not authorize, and sudden requests to review papers outside your field of expertise.
Peer review accounts represent valuable targets for bad actors because they grant access to unpublished research, confidential author information, and the ability to influence editorial decisions. Compromised accounts have been used to steal pre-publication data, manipulate acceptance decisions, and damage researchers’ reputations. Understanding how to identify these breaches early is essential because the longer an attacker maintains access, the more damage they can inflict on both your academic standing and the integrity of the research you review.
Table of Contents
- What Does Unauthorized Activity Look Like in Peer Review Systems?
- Password Changes and Authentication Anomalies
- Unauthorized Reviews and Submission Changes
- Profile Changes and Credential Exposure
- Delayed Discovery and Cascading Damage
- API Access and Automated Attacks
- Verifying Your Account’s Integrity
- Frequently Asked Questions
What Does Unauthorized Activity Look Like in Peer Review Systems?
Unauthorized activity typically appears as decisions or communications made in your name without your knowledge. You may receive rejection emails from journal editors thanking you for your review, or discovery notifications about papers you evaluated, when you performed no such review. Some accounts experience cascading fake reviews—an attacker reviews ten papers in a single week, a volume that would be impossible given your actual workload and expertise timeline. A researcher at a Dutch university discovered forty-three attributed reviews in three weeks; she normally completed five per year.
The activity often clusters in specific time windows—particularly late night or early morning hours in time zones far from where you actually work. Some attackers immediately attempt to change reviewer recommendations, downgrading acceptances to rejections or vice versa to influence decisions. In one documented case, a compromised account downgraded five papers to “reject” within hours; the editor caught the anomaly because the reviewer’s prior feedback on methodology was contradicted by the sudden reversals. Journal tracking systems now flag accounts that reverse historical recommendations, but older systems and smaller journals may not detect this pattern.
Password Changes and Authentication Anomalies
An attacker’s first action after compromising your account is typically to change the password and recovery email, locking you out of your own account. You may discover this when you attempt to log in for legitimate work and encounter “incorrect password” errors, only to find that the email address on file has been altered to something you don’t recognize. This authentication lockout is a critical warning sign because it indicates the attacker is consolidating control and preventing you from discovering the compromise quickly.
Multi-factor authentication (MFA) presents a significant barrier to account takeovers on platforms that implement it, yet many peer review systems lack this security layer entirely. Publons, the Thomson Reuters-owned peer review platform, did not require MFA for years despite hosting millions of researcher profiles and managing sensitive manuscript data. Even with MFA enabled, attackers sometimes bypass it through SIM-swapping attacks on your phone number or compromise of your backup authentication methods. The limitation here is clear: MFA is only as strong as its weakest component, and many researchers reuse backup email addresses across multiple compromised platforms, creating a cascade risk.
Unauthorized Reviews and Submission Changes
An attacker controlling your peer review account gains the ability to review manuscripts you never evaluated, potentially writing careless or deliberately sabotaging feedback. You discover this by finding review notifications in your email for papers outside your expertise—one researcher found herself credited with a detailed microbiology review despite her specialization in medieval history. These unauthorized reviews may contain generic, AI-generated, or nonsensical feedback that damages your credibility when editors or authors recognize the inconsistency.
In more sophisticated attacks, the attacker may submit fabricated research to journals using your account, committing your professional reputation to work that is not yours. They may also access draft papers and author communications that were intended to be confidential, forwarding sensitive information to competitors or attempting to publish the results first under their own name. One case involved an attacker accessing a researcher’s personal notes about a novel cancer treatment approach and publishing a competing paper weeks before the legitimate researcher’s planned submission. The researcher had no way to prove she owned the original work because her accounts had been compromised and backdated records appeared to show the attacker’s submissions first.
Profile Changes and Credential Exposure
Compromised accounts often show alterations to your profile information that you did not make—your institution may be listed as a competitor’s lab, your research interests may be changed to completely different fields, or your biography may be replaced with the attacker’s credentials. These changes serve multiple purposes: they obscure the attacker’s identity, redirect credit for your reviews to a false persona, and may position the attacker as a legitimate expert in your field for future fraudulent activity.
Some attackers harvest the contact information of authors and editors from your account, building email lists for phishing campaigns or selling the data to research institutes in countries with lower privacy standards. A comparison worth noting: while conventional email account compromises expose your contacts to spam and phishing, a peer review account compromise exposes leading researchers and journal editors—high-value targets for academic espionage. The attacker gains access to preview manuscripts before publication, a form of insider trading in the research world with direct financial value to biotech companies, pharmaceutical firms, and competing research groups.
Delayed Discovery and Cascading Damage
Many researchers don’t discover their compromised peer review account for weeks or months because they don’t log in frequently. You may only notice when a colleague mentions reviewing a paper you don’t remember, or when an editor contacts you directly about an unusual review you submitted. This delay allows the attacker an extended window to cause damage—publishing unauthorized reviews, sabotaging competing research through negative feedback, or stealing confidential data. One researcher discovered her account had been active for three months after compromise, during which time the attacker reviewed twelve papers and changed the associated email address twice, each time resetting the recovery mechanism.
The challenge in detecting compromise is that peer review platforms often send weak or no notifications for successful login attempts. Unlike consumer email services that alert you to new sign-ins, many academic platforms only notify you of password changes—meaning an attacker can access your account dozens of times without raising an alarm. Some platforms have incomplete audit logs or do not retain them long enough for forensic analysis. A limitation particularly relevant to older systems: they may lack the infrastructure to prove when a specific review was written or from which IP address it originated, making it nearly impossible to prove that a review was unauthorized even after you discover the compromise.
API Access and Automated Attacks
Advanced attackers sometimes target peer review accounts through compromised institutional credentials or data breaches on university authentication systems. They use your credentials in combination with API keys or tokens to automate attacks—submitting bulk reviews, harvesting author databases, or changing account settings programmatically. This is particularly dangerous because the attacker can affect dozens of accounts or take actions at scale without manually logging into each system.
If your institution uses federated login (single sign-on through a university identity provider), a compromise at the institution level can simultaneously compromise your peer review accounts and other academic service accounts. One university’s data breach exposed credentials for five thousand faculty members; attackers used those credentials to access and manipulate peer review accounts on three separate platforms before the institution detected the initial breach. The attacker targeted researchers in biomedical fields and engineering, specifically sabotaging reviews for papers that would compete with research the attacker’s own organization was conducting.
Verifying Your Account’s Integrity
To verify whether your account has been compromised, check the login history or recent activity log on the peer review platform if it provides one. Look for login attempts from unfamiliar IP addresses, particularly those geographically distant from your location. Request an account audit from the platform’s support team—they may be able to provide a full list of actions taken from your account over the past three to six months, including reviews submitted, profile changes, and contact information modifications.
If you discover a compromise, change your password immediately using a different device or network, enable multi-factor authentication if available, and review all associated accounts for similar compromises. Notify the journal editors or review coordinators of the breach so they can investigate the reviews attributed to your account. Check whether your institutional credentials were also compromised; if so, reset your password through your institution’s authentication system as well. In serious cases where unauthorized reviews have influenced editorial decisions, you may need to contact the journal’s editorial office to request a formal investigation and retraction of reviews that were not legitimately yours.
Frequently Asked Questions
How can I check if my peer review account has been compromised?
Log in to your peer review platform and review the login history, recent activity log, and profile changes. Request a full account audit from the platform’s support team. Check for login attempts from unfamiliar locations and dates when you were not actively reviewing papers.
What should I do immediately after discovering a compromise?
Change your password from a different device, enable multi-factor authentication, and contact the journal editors about unauthorized reviews. Notify your institution’s IT department and check whether your institutional credentials were also compromised.
Can an attacker publish research under my peer review account?
No—peer review accounts typically cannot submit manuscripts, only review them. However, if an attacker gains access to your email address or institutional login, they may access your author accounts on the same platforms and submit fraudulent papers in your name.
Why do some peer review platforms lack multi-factor authentication?
Many academic platforms were built before MFA became standard security practice. Some platforms prioritize accessibility and ease of login over security, assuming that researchers would choose strong passwords—an assumption that has proven incorrect.
How long can an attacker maintain access to a compromised peer review account?
Without detection, months or longer. Many researchers log in infrequently and may not notice unauthorized reviews for extended periods. Attackers often reset recovery email addresses and passwords to prevent the legitimate owner from regaining access.
Is there a way to recover my reputation after an unauthorized review has been published?
Yes, contact the journal’s editorial office and request a formal investigation. Provide evidence of the compromise (login records, password change dates, etc.) and ask the editor to retract or flag the unauthorized review. Most reputable journals will remove your attribution if you can demonstrate the account was compromised.