The Outlier Lab

Login Anomalies

Deviations in how, when and from where an account authenticates: the first visible step of most account takeovers that end in withdrawals, liquidations or redemptions.

What it measures

Login anomalies are a composite signal. Practitioners usually track four layers:

LayerExamples of features
Per-account deviationNew device or browser family; new ISP/ASN or country; unusual hour; first login after long dormancy; factor used differs from habit (SMS when the customer normally uses a passkey)
Attempt patternFailures before success; password vs. username errors; lockouts; resets initiated then completed; OTP requests without completion
Population patternGlobal failure-rate spikes; many accounts per device or IP; success rates on login endpoints far below baseline (a stuffing signature)
Login-to-value pathTime from login to the first sensitive action; navigation straight to balances, payout settings or the sell ticket; no browsing of the things this customer usually looks at

The login-to-value path is what makes this a transaction-fraud signal rather than a pure identity signal: a strange login matters most when it is followed quickly by a withdrawal, a liquidation, a gift-card redemption or a P2P send.

Why it matters

Most third-party transaction fraud on existing accounts starts with someone authenticating who shouldn't. FinCEN's analysis of identity-related BSA filings for 2021 found compromised credentials in 18% of reports but 32% of the dollar value (about $112 billion), so credential compromise skews toward large losses. SAR filings tagged account takeover rose 7.2% in 2025 and 134% since 2020, per an EPCOR summary of FinCEN SAR statistics.

Since 2023 the mix has shifted. Credential stuffing still produces noisy, detectable waves, but more losses come from methods that produce a clean-looking login: adversary-in-the-middle phishing that relays a real MFA challenge, and infostealer-harvested session tokens that skip login entirely. A login anomaly program built only on "failed attempts" and "new country" misses both.

The pattern differs by industry. In Brokerage and Investing, it's a new-device login followed by sell orders and a new bank link. In Cashback, Coupons and Rewards, low-value accounts are tested at scale until balances worth redeeming turn up. In Payments and P2P, it's a login, a new payee and an instant send within minutes.

How to collect it

  • Identity provider / auth service logs: every attempt, outcome, factor offered and used, error type, lockout, reset. Log failures with the same fidelity as successes.
  • Client signals from Device Fingerprinting, Automation and Headless Browser Signals and Behavioral Biometrics (typing cadence on credential fields, paste events).
  • Network enrichment from IP Reputation and Proxy Detection and Geolocation and Impossible Travel.
  • Breach exposure via Breached Password Detection. Knowing a credential is public changes how you read an otherwise normal login.
  • Build vs. buy: identity platforms and bot-management vendors sell login risk scores. They see cross-customer attack patterns you can't, but they don't know your customers' habits or what happens after login. Most mature programs blend vendor scores with an in-house per-account baseline and post-login behavior.

How to use it

Strengths and limitations

Strengths: high coverage (every account authenticates); fast; well understood by product and security partners; strong for volumetric attacks.

Limitations: device, network and location attributes can all be spoofed or borrowed, and well-resourced attackers increasingly make logins look normal. Relay phishing produces a legitimate MFA completion; session theft produces no login at all; scam victims log in themselves from their own device. Treat a "clean" login as the absence of one kind of evidence, not as proof of legitimacy, and rely on downstream signals (Transaction Pattern Anomalies, Scam Victim Indicators) for those paths.

False positives and fairness

  • Travelers, commuters on mobile networks, and corporate or privacy VPN users.
  • New phones, OS upgrades, browser privacy features that reset identifiers.
  • Shared household devices and accounts managed by family members.
  • People with disabilities who use assistive technology or password managers that alter typing or timing signatures.
  • Customers in regions where your vendor's IP data is thin, who may score as "unknown" more often.

Measure step-up and lockout rates by segment; a login model that disproportionately locks out one population creates both CX and fairness risk (see Friction and Customer Experience Tradeoffs).

Privacy and compliance considerations

Login telemetry includes IP addresses and device identifiers, which are personal data under most privacy regimes; collect for fraud and security purposes, disclose it, and set retention to match your investigation and dispute windows. Broker-dealers should map login red flags into their Reg S-ID identity theft program (see Broker-Dealer Obligations (FINRA and SEC)). See Privacy and Data Use in Fraud Prevention.

Mechanisms it helps detect

Account Takeover (ATO) · Credential Stuffing · Phishing and Credential Harvesting · MFA Bypass and OTP Interception · Session Hijacking and Infostealers (via missing or inconsistent login events) · Multi-Accounting (many accounts, one device)

Device Fingerprinting · IP Reputation and Proxy Detection · Geolocation and Impossible Travel · Automation and Headless Browser Signals · Velocity Signals · Bot Management and CAPTCHA · Rate Limiting and Throttling · Multi-Factor Authentication (MFA) · Playbook - Account Takeover Members

Sources and further reading