Impossible Travel

The core mathematical engine computes the great-circle distance between two successive login coordinates and divides it by the elapsed time to derive a required travel speed. If this speed exceeds a defined threshold—typically the maximum speed of commercial aviation (approx. 600 mph / 965 km/h)—the event is flagged. The engine must account for terrestrial constraints, rejecting straight-line paths that ignore ocean crossings or geopolitical no-fly zones. Advanced implementations incorporate a buffer for airport transit time and security screening.

The time delta between Event A and Event B is the critical divisor in the velocity calculation. Configurations must be tuned to the organization's risk appetite:

• Strict Window: A 1-hour threshold catches rapid, automated credential stuffing but may generate noise from mobile IP refreshes.
• Relaxed Window: A 4-8 hour window accounts for legitimate long-haul flights but risks missing a takeover where the attacker waits.
• Sliding Window: Analyzes the last N events rather than just the immediate predecessor to detect multi-hop attack patterns.

The accuracy of an impossible travel rule is entirely dependent on the fidelity of its IP-to-location mapping. Common sources include:

• Commercial GeoIP Databases: MaxMind, IP2Location, and NetAcuity offer varying precision at the city, postal code, and coordinate levels.
• BGP and Latency Triangulation: Network-level data can validate commercial database claims by measuring round-trip time.
• GPS/Wi-Fi Triangulation: For mobile applications, on-device location services provide high-confidence coordinates that bypass IP spoofing entirely. A robust system cross-references multiple signals to detect IP spoofing or VPN exit node usage.

To prevent false positives that disrupt legitimate users, rules require sophisticated exception handling:

• Known VPN/Carrier NAT: Traffic from known VPN providers or mobile carrier gateways (which can geolocate to a central office far from the user) is suppressed or scored differently.
• Trusted Device Recognition: If the new login originates from a previously device-fingerprinted and remembered browser, the risk score is reduced.
• Multi-Factor Authentication (MFA) Status: A successful MFA challenge on the anomalous event can suppress the alert, treating the travel anomaly as a curiosity rather than a threat.
• Airport Wi-Fi Networks: IP ranges associated with known airport networks can be whitelisted or given a higher velocity tolerance.

Impossible travel is a specific subset of velocity analysis. While impossible travel focuses on the physical impossibility of movement, frequency analysis detects a logical impossibility of usage:

• Single-User Velocity: How many distinct accounts is a single IP accessing per minute? High velocity indicates a bot or shared attack infrastructure.
• Single-Account Velocity: How many distinct IPs are accessing a single account per hour? This detects credential stuffing where a botnet distributes login attempts globally.
• Hybrid Rules: Combining geovelocity with account/IP frequency creates a high-precision detection net that catches both targeted takeovers and broad brute-force attacks.

Upon flagging an impossible travel event, the system must execute a risk-based authentication (RBA) workflow:

1. Step-Up Authentication: Prompt for a second factor (TOTP, push notification, hardware key) without revealing the reason.
2. Session Termination: If the risk score is extreme, actively invalidate the session token on the anomalous access point.
3. Administrative Hold: Place the account in a restricted state, preventing fund transfers or data exports until a manual review is completed.
4. Threat Intelligence Ingestion: Feed the anomalous source IP and fingerprint into a blocklist for other security systems.

The real-time calculation of the speed required to travel between two successive geolocated access points. If the computed velocity exceeds physical possibility (e.g., a login from New York followed by a login from London 15 minutes later), the event is flagged. The formula is straightforward: distance / time_delta. However, production systems must account for GPS spoofing, VPN exit node latency, and imprecise IP geolocation to avoid false positives.

The process of identifying traffic originating from anonymizing infrastructure. Impossible travel logic must distinguish between a genuine account takeover and a legitimate user connecting through a corporate VPN or privacy service. Detection methods include:

• Cross-referencing IPs against known VPN exit node databases
• Analyzing TCP/IP stack inconsistencies and round-trip times
• Detecting DNS leaks that reveal the true originating network

A login from a VPN exit node in a distant location should not automatically trigger an impossible travel alert if the user's historical behavior includes VPN usage.

An adaptive security framework that dynamically adjusts authentication requirements based on a real-time risk score. Impossible travel is a high-weight signal within the RBA scoring engine. Typical responses to a high-confidence impossible travel event include:

• Step-up authentication: Requiring a one-time passcode or hardware token
• Session termination: Forcing re-authentication on the suspect session
• Silent alerting: Flagging for SOC review without user friction

RBA ensures that the response is proportional to the calculated risk, balancing security with user experience.

A security mechanism that persistently validates identity throughout a session rather than relying on a single point-in-time login. After an impossible travel event is resolved (e.g., through step-up authentication), continuous authentication monitors:

• Keystroke dynamics and typing cadence
• Mouse movement entropy and scroll patterns
• Touchscreen pressure and gesture analysis on mobile

This ensures that even if an attacker passes the initial challenge, their post-login behavioral patterns will eventually betray them.

The identification of an attack where a valid user session is compromised, typically through stolen cookies or tokens. Impossible travel is a primary detection signal: if a session token that was issued in San Francisco suddenly presents from Jakarta without a corresponding login event, it indicates session theft rather than credential compromise. Detection combines:

• Abrupt geolocation shifts mid-session
• Changes in device fingerprint or browser environment
• Anomalous clickstream behavior post-hijack