The contractor who we were paying was known by other employees, so when someone else called into a status report sounding different they contacted my group (IT/Security). He was a devops engineer so we had to comb through all the access logs to ensure he (or his subcontractor with his credentials) did not access patient data (of course this was a medical project with HIPAA). Luckily he was just working on our QA environment so there was no risk of data exposure, but it could have been worse.

We were all shocked at how bold that move was!