Impossible travel

When the same account is used from two places too far apart for one person to have traveled between them in the time available.

If an account signs in from one country and, ten minutes later, from another on the other side of the world, the person could not have made that journey.

A detection rule that compares the locations and times of two logins or actions on one account and flags them when the implied travel speed is not physically plausible. Location usually comes from IP geolocation, which estimates where an internet connection is based.

The check works like this:

1. The system records the time and estimated location of each login.
2. It measures the distance between two consecutive logins and the time between them.
3. It calculates the speed that would be needed to travel that distance.
4. If the speed is faster than any realistic travel, it raises a risk signal.

The check has well-known sources of false alarms:

• VPNs and proxies, which make a connection appear to come from another country.
• Mobile networks, which can route traffic through distant gateways.
• Corporate networks, which can exit to the internet from a central location.
• Imprecise geolocation, which can place an address in the wrong city or region.

Teams reduce false alarms by combining it with other signals, such as whether the device is one the person has used before.

Impossible travel sits next to terms that are easy to mix up:

• IP intelligence supplies the location and network data that the check uses.
• Account takeover (ATO) is the kind of attack the check helps to catch.
• Device fingerprinting helps tell a known device from a new one, which settles many borderline cases.