There is a table called MBRAPPSTAT which holds records of various API calls done during the entire member authentication process, even before they have successfully logged in to online banking (even if through the mobile app). That is the first place TO look to see records of what's happening with this member's account as they step through that process. There is one row for each API call, and each API call represents a different phase of the process. For example - Get Username, Get Challenge Question, Answer Challenge Question. If searching for a specific member, it is most helpful to sort the data in this table by the Account Base first, then by Last Update Timestamp. This organizes the data into the same order of actions that your member stepped through as they proceeded through the login process.

Secondly, the table called AUDICC will hold records of successful logins only. You would need to filter this to only the 'I' records by the CCTYPE field. There are also 'P' records which only relate to CU*Talk. A standout characteristic of this table is that it collects an IP address for each login. This can be helpful in determining if there are actually unrecognized devices accessing the account in question. The member can also review this themselves right inside It's Me 247 via the Login History page (under Info Center). Keep in mind that mobile IP addresses will rotate quite often so if you or the member sees variability on IPs for mobile logins, it may not necessarily be suspicious. We recommend focusing more on time of day to determine if those should be suspect or not. 

Last table to consider is PCMBRPINH which holds records of various password/PIN events like changes, resets, change reminders, lock-outs (disabled), etc. You'll want to focus on the PNRSNCOD - Change Reason Code field. But keep in mind in this case Tool #505 Member PIN/Password Change History also has the same information you can easily search out via the tool rather than Query. 

See the "PIN Change Reason Master Maintenance" related content link below to view a list of the various system Change Reason codes you may see in PCMBRPINH (also available to see via a look-up in Tool #505, and they are configured in Tool #268 Configure PIN/PW Reset Reason Codes).