The first operational evidence that something was abnormal on United 175 came at 8:47, when the aircraft changed beacon codes twice within a minute.
They knew something was wrong when the craft changed beacon codes swiftly.