What is impossible-travel detection?¶

Impossible-travel detection compares two account events and flags that their estimated network locations are too far apart for one person to travel between them in the available time. It is a provider-generated risk assessment, not direct measurement of either person's physical location.

The calculation begins with two observations¶

Dave uses SharePoint from Northstar's London office at 09:03. Twelve minutes later, another event for his account appears from an IP address geolocated to Frankfurt. A provider may compare the two times and location estimates and generate a travel-risk detection.

Network exits can move without the person moving¶

The IP address may describe a VPN exit, mobile gateway, corporate security service, cloud-hosted application or other intermediary. Geolocation databases are estimates and providers apply different behavioural models. A second device can also perform background activity while Dave is using the first.

Preserve both underlying events, not just the alert: full timestamps, IP addresses, sessions, devices, applications, authentication methods, resource actions and the provider's detection type, risk level and generation time. Then compare provider/network ownership, known VPN routes, device records and the account's normal pattern.

An unusual-location alert explains how to state the resulting proposition. What an IP address can establish supplies the provider-neutral reason the inferred location cannot be treated as a person's coordinates.

The durable principle¶

Impossible travel is a comparison between provider observations. It is useful because it focuses attention on two sessions and their actions; it remains limited because network location is not the same proposition as human location.