Anomalous login detection

Last verified: 2026-07-08.

Awthy watches where and how each account signs in and flags sign-ins that do not match a user's normal pattern, so a sudden sign-in from the other side of the world is something you notice quickly. Detection and the on-next-login in-app notice are free.

What triggers an anomaly

Awthy learns a baseline from each user's first few sign-ins, then compares every later login against it:

New location — a sign-in from a country, region, or city the account has never used before (for example, an account that always signs in from South Africa suddenly signing in from the United States).
Impossible travel — two sign-ins so far apart in distance and so close in time that no real journey could connect them (for example, ~900 km/h or faster). This needs precise coordinates and is only available on the DB5 geo database tier; see Geo database setup.
Unusual time — a sign-in well outside the account's usual time-of-day pattern.

Location is always approximate, based on the IP address. IP geolocation is not exact, so Awthy treats it as a signal, not proof.

During the learning window (the account's first few sign-ins, or its first two weeks) Awthy quietly builds the baseline and does not raise alerts, so a brand-new account is not flagged for simply being new.

Free in-app notice vs paid email alert

Capability	Tier
Detection	Free
On-next-login in-app notice (shown in the dashboard / at next login)	Free
Routing the same anomaly to email	Paid

When an anomaly fires, Awthy always writes the free in-app notice. The notice asks the user "this was me / wasn't me":

This was me teaches the baseline, so the same location stops being flagged.
This wasn't me points the user to secure the account — change the password, review sessions, and check recovery options.

If the paid email entitlement is active, Awthy also sends the anomaly as an email alert. Without it, the in-app notice is still the user's signal, alongside a prompt to upgrade for email delivery.

Per-user and per-role enablement

Detection is on by default for all users. An administrator can enable or disable it per user and per role under Awthy Security → Login activity, so you can scope it to the roles that matter (for example, administrators and shop managers).

Login Activity lists every stored user and role override. Administrators can change a forced-on or forced-off value, or clear the override to return that subject to the default-on policy.

The Login Activity page is where administrators review anomaly settings, recent login signals, and geo database state. Use it to check whether an account is still in the learning window, whether email routing is available for the active plan, and whether the local geo database is current.

Login Activity is not a raw tracking feed. It summarizes security-relevant login dimensions and keeps location approximate.

Geo database cross-links

New-location detection works with the default DB3 database. Impossible-travel scoring needs DB5 because DB5 includes latitude and longitude. See Geo database setup before enabling DB5 so you understand the larger download, monthly refresh behavior, Hub-managed download option, and required IP2Location attribution.

False positives: VPNs and travel

A few situations look anomalous but are legitimate:

VPNs and proxies move your apparent location to the VPN exit server. Awthy downgrades sign-ins from known anonymizer networks so they are less likely to alert, but a VPN can still surface a "new location" notice.
Real travel genuinely changes your location. The first sign-in from a new place may alert; answering "this was me" teaches the baseline so the trip's location is accepted.
Mobile / carrier-grade NAT can shift your apparent region between sign-ins. Awthy ignores very short location jumps and requires a minimum time gap before treating a move as impossible travel.

If a user travels often or always uses a VPN, "this was me" quickly trains the baseline and the noise settles down.