Whilst it is suspicious, the controller won't necessarily take action straight away. Its usually better to wait till something worth taking action on since you are still constantly recording their key strokes/bank pins etc. Whats one day worth of logins and information compared to like a month or two of logins and information. Imo if you use a authenticator (from your phone) then you should be fine unless the controller has the account's recovery information