A method is provided for detecting an interception of a communications session established by a user over a network, comprising the steps of: (i) monitoring communications sessions by the user over a profile time period to capture information identifying distinct communications to one or more identified network addresses and their timing over the profile time period; (ii) monitoring communications sessions within the profile time period to capture information characterising the content of transactions initiated in respect of said one or more network addresses; (iii) using the captured information to generate a profile characterising communications sessions established in respect of said one or more network addresses over the profile time period; and (iv) monitoring communications sessions with said one or more network addresses within a configurable detection time period to determine one or more measures of deviation from the profile generated at step (iii) thereby to detect the presence of an interception occurring within the detection time period.