Records Created, Updated or Deleted Unexpectedly

When Salesforce records are created, updated, or deleted without an obvious user action, the cause is typically client-introduced automation such as Workflow Rules, Process Builder, Flows, Apex Triggers, or API integrations — not a Salesforce platform bug.
Key points to understand:

Salesforce's #1 value is Trust. Salesforce does not manipulate customer data without consent, and standard application functionality does not intentionally update or modify customer data randomly or unexpectedly.
Unexpected data changes are typically caused by user actions (direct or indirect) through automation, integrations, or API calls running in the affected user's context.
It is not within the scope of Salesforce Support to review and analyze customer metadata, customizations, automation, or user actions to identify the source of record changes.
Due to GDPR compliance changes, retroactive identification of which user committed a record change may no longer be possible. See Salesforce's Privacy Information for more.

The following tools and strategies are available to help administrators investigate the source of unexpected changes.

Warning
Always back up your data before performing any data operation. See Export Backup Data from Salesforce or Export Data for more details. It is recommended to run a test with a small subset of records to ensure the operation was successful through manually opening and verifying that the corresponding records are correct in Salesforce.

Record Deleted or Missing

For deleted records, refer to Find out who deleted a record in Salesforce and Recover records and data in Salesforce.

Record Updated or Modified

If an unexpected change has already been made, check the record's System Fields — specifically LastModifiedById and LastModifiedDate. These fields provide critical insight into when and who last modified the record.
Customers with Shield Event Monitoring may be able to review event logs to retroactively identify automation influencing the changes.

System Audit Field Considerations

If the record was modified after the unexpected change, set up a test record and use the strategies in this article to catch the change as it happens.
If your org has the Enable Create Audit Fields permission active, another admin user may be performing insert operations that set unexpected audit field values. Best practice is to enable this permission only for as long as necessary, then promptly disable it.
To check whether "Set Audit Fields upon Record Creation" or "Update Records with Inactive Owners" was recently enabled, download your org's Setup Audit Trail. See Monitor Setup Changes with Setup Audit Trail.

Tracking down these types of changes can only be done client-side or internally by customers through:

Strong change management practices. It is considered best practice to only enable the feature for as long as necessary to complete required data operations then promptly turn it off to ensure data integrity.

Strict controlled assignment of the 'Set Audit Fields upon Record Creation' profile permission.

Organizational coordination and communication.

To see if 'Set Audit Fields upon Record Creation' and 'Update Records with Inactive Owners' may have been enabled download and search your organization's 'Setup Audit Trail.' Follow the steps to 'Set Audit Fields upon Record Creation,' as detailed in the Monitor Setup Changes with Setup Audit Trail documentation.

Investigating via LastModified Fields

Create a report to see if the LastModifiedBy user modified similar records on the same date — this may indicate a data load or import.
View Bulk Data Load Job Details to identify potential record update operations.
Run a SOQL query via Data Loader to identify records modified within the same time frame (+/- 5 seconds). See Data Types Supported by Data Loader for date format guidance.
If several records were modified within seconds of each other, automation is likely running in batch — not a user manually editing records.
Review the LastModifiedBy user's login history for API logins that correlate to the date and time of the change. See View and Manage Users.

Unable to Identify Source of Change

If the behavior is ongoing and specific field values are changing unexpectedly, an admin can set up Field History Tracking or Feed Tracking to capture who and when the changes are being made.
Monitoring steps:

Ask users to document: exact link to the affected record, exact fields changed (previous and new values), and the date, time, and timezone of the change.
Monitor the record over a period when unexpected changes are common. Document: the exact date and time the user noticed the unexpected update, the LastModifiedBy user and timestamp before editing, and which fields were changed unexpectedly.
If the record is commonly updated shortly after a user saves it, coordinate with the affected user to Set Up Debug Logging to capture automation details.
For intermittent issues, review Troubleshooting Intermittent Issues and Support Case Recommendations.
Review Field Update Actions, Process Builder, and Flows on the affected object.
Work with developers to review Apex Triggers on the object. See View Apex Trigger Details and Understanding Dependencies.

Record Manually Updated

Ask the user if they intentionally made the change, and review the click path they followed.
Review the user's day-to-day interactions with the object to identify patterns.

Record Updated via API or Integration

If unknown API logins are present, use the login's source IP in the ARIN Whois-RWS lookup to identify the organization behind the IP address.

Common integrations known to cause unexpected Activity (Task and Event) record updates include: Salesforce Open CTI, Salesforce Call Center, Salesforce for Outlook, Lightning Sync for Microsoft Exchange, Outlook and Gmail Integration, Salesforce AppExchange Email & Calendar Sync apps, and Einstein Activity Capture.

Temporarily remove the affected user from the suspected integration and monitor whether unexpected changes continue. If changes stop, reintroduce each integration individually to identify the source.