Detect impossible travel

Impossible travel is the scenario where a user moves between two locations faster than possible by any means of travel. It is a simple form of anomaly detection and could be an indication that the account is compromised. There are a few other reasons why impossible travel can happen, including:

The user is using a proxy that is turned on or off between requests, causing a sudden jump in location. (However, the Castle signal "Impossible travel" will not trigger for the same device, which removes this behavior from being flagged)
A sign of phising or malware
Account sharing, i.e. two or more physical users are sharing the account

Nevertheless, when impossible travel happens, it could be a sign of unwanted behavior that warrants additional attention. With Castle it's easy to spot impossible travel by using signals.

Step 1. Find users with impossible travel

In the Explore view:

Add a filter for the "Impossible Travel" signal.
Optionally add the "New Device" signal to focus on higher-risk logins.
Group the results by user to review the affected accounts and activity.

Use the Explore guide for filtering and grouping details.

Step 2. Create a policy to challenge impossible travel

Follow the steps how to create a policy , and provide these options:

For name, use e.g. "Challenge impossible travel"
For event group, select "Login Succeeded"
For inline action, select "challenge"
For trigger condition, selects Signals and then "is one of Impossible travel, New device".
Verify the settings and hit "save"

Finally, enable and re-order the policy to put the new policy to work