Could changing a password alert another user?¶

Yes. Providers may send email, text, push or administrative alerts and record the reset in account-security history.

A protective action can expose the investigation¶

Another user may respond by deleting evidence, recovering the account or moving activity elsewhere. A reset can also terminate sessions that hold useful context.

Record current session, identifiers, linked devices, recovery routes, sign-ins and warnings first. Preserve notification destinations because they may identify other accounts or people.

Password change is not complete containment¶

Existing tokens, delegated access, application passwords and recovery methods may remain. Consider narrower or coordinated controls.

If ongoing harm requires change, record authority, operator, time, device, warnings, confirmation and every alert or session result. A justified safeguard still creates an evidential event.