User Perception
Alerts for SIC hoppers

There should be a chance that when a Decker tries to pull the SIC ID from someone, or run #probe-user, that the target gets an alert. Could be a some sort of roll involving perception and systems, perhaps? Modified by cyberware? Maybe depending on the results of the roll, the target gains more or less information, if any information at all.

This sounds a lot like what Daemons do for devices.
Would be cool if you could monitor your grid account/any other grid account your term has previously logged in to (would require also a way of pulling a list of accounts the term has accessed) as well as maybe monitoring your SIC chip by SICid with Daemons in the same way.