What is impossible-travel detection?¶
Impossible-travel detection is a security rule that flags account activity appearing from locations too far apart to have been reached within the time available.
For example, the same account may appear to sign in from London and Singapore within a short period.
What this means in practice¶
The alert is based on estimated location, usually derived from IP addresses. Those estimates can be affected by VPNs, proxies, mobile networks, corporate gateways, cloud security services and provider routing.
A user may also have several active sessions on different devices. One device may continue background activity while another is used elsewhere.
The alert can still be useful. It identifies a pattern that needs explanation and may point to compromise, shared access or unusual infrastructure.
Also check whether the provider’s location data is accurate and whether one address belongs to a known VPN, corporate network or mobile carrier.
What this does not show on its own¶
The dangerous assumption is that an impossible-travel alert proves two different people accessed the account.
What to do next¶
Check the underlying records rather than relying on the alert label alone. Identify the IP addresses, timestamps, session identifiers, devices, applications and whether the events were fresh authentications or continuing sessions.
Compare the events with travel records, work activity, device possession and the user’s normal access pattern.
Do not assume that absence of an impossible-travel alert proves the account was secure. An attacker may use infrastructure close to the victim, reuse an existing session or avoid generating a fresh login.
Key takeaway
Impossible-travel detection is a risk indicator based on estimated locations, so examine the underlying sessions, devices and networks before treating it as evidence of compromise.