What is impossible travel?
Impossible travel is a detection signal that fires when one account is used from two locations far enough apart that no ordinary journey could connect them in the time elapsed. A login from Chicago and, nineteen minutes later, another from Warsaw is the canonical example: both events are individually unremarkable, and together they describe something that did not happen.
How impossible travel is detected
The calculation is simple. Take two events from the same account, estimate each location from its IP address, measure the great-circle distance, and divide by the time between them. If the implied speed is beyond what a person could plausibly manage, flag the pair.
The difficulty lies in the inputs, not the arithmetic. IP geolocation is approximate and can be wrong by an entire country. Mobile networks route traffic through egress points nowhere near the handset. VPNs relocate users instantly and repeatedly by design. Treat every endpoint as ground truth and the signal produces false positives faster than anyone can review them.
Why it matters
Impossible travel is one of the few signals suggesting that two people are using one account, the defining characteristic of account takeover. Stolen credentials get used from wherever the buyer happens to be, which is rarely on the same continent as the account's owner. The signal can also surface shared or resold accounts, where a subscription intended for one person is quietly serving several. It is established enough to be a named product feature elsewhere: Microsoft Defender for Cloud Apps ships an Impossible travel anomaly detection, which Entra ID Protection surfaces as Atypical travel. Microsoft's implementation discounts VPNs and locations common to an organization, and runs a learning period of 14 days or 10 sign-ins before judging a new user, which is a useful confirmation that the raw signal is not usable without exactly this kind of dampening.
How Dregs handles it
Dregs ships impossible travel as a standard analyzer, deriving each event's location by matching it to the device that produced it. Pairs where either endpoint is a known VPN, proxy, or Tor exit are excluded, since an exit node's location says nothing about where the user is. The result contributes to the Behavior score rather than triggering an automatic block, and it corroborates rather than duplicates the account-takeover analyzer, which sequences credential changes against device novelty.
Every observation shows the distance, elapsed time, and two endpoints behind it, so an analyst can see exactly why the pair was flagged. Those involving a traveling salesperson with an enthusiastic VPN client can then be dismissed quickly.
Frequently Asked Questions
Q: Is impossible travel the same as geo-velocity?
A: They describe the same calculation from different angles. Geo-velocity is the measurement (distance divided by elapsed time, expressed as an implied speed); impossible travel is the verdict you reach when that implied speed exceeds what any real journey could produce. Some vendors use the terms interchangeably, and in practice you can treat them as one signal.
Q: Do VPNs cause false impossible travel alerts?
A: Constantly, and this is the single biggest source of noise in the signal. A user who connects through a VPN exit in another country, then drops the VPN, produces a textbook impossible-travel pair without going anywhere. The same happens with corporate egress, mobile carrier CGNAT, and cloud-hosted browsers. Any usable implementation has to discount endpoints that are known VPN, proxy, or Tor exits, because an exit node's location is not evidence that a person moved.
Q: What is a reasonable impossible travel threshold?
A: Most implementations fire somewhere above 500 to 900 km/h implied speed, which sits above commercial flight but leaves room for timezone and geolocation imprecision. The threshold matters less than the exclusions, though. Tightening the speed limit mostly generates false positives, whereas discounting VPN exits and low-confidence IP geolocation removes whole classes of them.
Further Reading
Detect impossible travel and other potential abuse signals on your site.
Dregs helps you detect impossible travel and other signs that an account may be compromised or shared. It scores location changes alongside device novelty, credential changes, and network reputation, giving you the context to act quickly.
Schedule a Demo