Impossible travel

Impossible travel is two access events for the same user separated by a distance and time that no real human could bridge. It's a strong indicator of both account takeover and account sharing: one person can't physically be in two places at once, so a session in São Paulo immediately followed by a session in Berlin is somebody else.

How Rupt computes it

For each evaluation, Rupt compares the current geolocation against the user's most recent access and checks two conditions:

• Distance: ≥ 500 km between the two locations, AND
• Required speed: ≥ 1000 km/h to bridge them in the elapsed time.

The window is 48 hours. Older sessions don't trigger the check, since enough time has passed that genuine travel becomes plausible. Both conditions must hold: a 600 km gap over a full day fails the speed check, and a fast turnaround across a small distance fails the distance check.

Using it

impossible_travel is exposed as a check and weights into both the account takeover and account sharing risk scores. To act on it in a policy, match the check directly:

If event_type = login AND impossible_travel = true → challenge.

Pairs well with

• Concurrency: if both flip true on the same evaluation, sharing is essentially confirmed.
• VPN / proxy / Tor flags: impossible travel through an anonymizer is a near-certain ATO indicator.
• New fingerprint: the geographic shift is more meaningful when the device looks new for the account too.

Edge cases

• Genuine air travel. Long-haul flights cover impossible-travel distances in plausible time and won't trigger the check (1000 km/h is faster than commercial aviation cruise speed). Short-haul or layover patterns also pass because the distance threshold isn't met.
• VPNs that flip locations. A user toggling a VPN can technically trigger impossible travel even when they aren't moving. The IP anonymity flags are factored in, so policies can decide whether to treat VPN-driven impossible travel as the same severity as physical impossible travel.