What AccountPermissionUpdate Does
One specific on-chain transaction type is responsible for every permission change on TRON, from a legitimate multisig setup to the scam that hijacks an account.
What it changes
AccountPermissionUpdate rewrites an account's Owner permission, Active permission(s), or both — replacing the list of keys, their weights, and the required threshold in a single transaction.
Who can submit it
Only a key (or combination of keys meeting the threshold) currently listed in the account's Owner permission can successfully submit this transaction. This is what makes Owner permission the ultimate gatekeeper — it controls who's allowed to change the gatekeeping itself.
Why it's the mechanism behind the scam
The multisig scam works entirely through this one transaction type: an attacker who controls an account's Owner key submits an AccountPermissionUpdate before handing the seed phrase to a victim, so the victim's key was never truly in control to begin with.
Why checking for it matters
Since this transaction leaves a permanent, visible record, comparing an account's current permission structure against the safe default is a reliable way to detect whether it was ever used — which is exactly what a permission checker automates.