What is a new-device or unfamiliar-login event?¶

A new-device or unfamiliar-login event is generated when an identity or security system sees a sign-in that differs from what it considers normal for the account.

That difference might involve the device, browser, IP address, location, application or pattern of use.

Avoid the dangerous assumption¶

The dangerous assumption is that an unfamiliar-login event proves an attacker accessed the account.

It does not.

The system is usually comparing the event with previous data. A legitimate user may sign in from a replacement phone, private-browsing session, new browser, hotel network, mobile connection or VPN. A software update may also change the device information presented.

The event may include the account, device characteristics, source address, location estimate, application, risk label and timestamp. This can help identify a sign-in that deserves further enquiry.

But “new device” does not always mean a physically new device. Cookies may have been cleared, a browser profile may have changed or the provider may not recognise the device because earlier data expired.

Likewise, an unfamiliar location is often inferred from an IP address. It may reflect a mobile network, VPN exit point or provider routing rather than the user’s true location.

Investigators should identify which characteristic triggered the event and how the provider defines unfamiliarity. Preserve linked authentication, session, device and risk records.

Compare the event with account activity before and after it. Look for password resets, MFA prompts, recovery changes, unusual actions and evidence from the user’s known devices.

Operational takeaway¶

A new-device or unfamiliar-login event identifies activity that differed from the provider’s normal pattern, but it does not by itself prove compromise, physical location or the identity of the person who signed in.