Your IdP flags a user with two successful sign-ins 15 minutes apart from Tel Aviv and São Paulo. No one travels that fast - so what do you actually do?
Step 1: Confirm it's real, not benign
- VPN / corporate egress? A VPN can make travel look impossible. Check whether one of the IPs is a known corporate or VPN range.
- Same device / session? Compare user agents, device IDs and session tokens. A reused token across two geographies is a strong theft signal.
- MFA status. Was MFA satisfied for both logins? A satisfied MFA from a new device still warrants scrutiny (MFA fatigue, token theft).
Step 2: Contain without breaking a legit user
The right first move is almost always to revoke the active sessions/tokens and force re-authentication (MFA). This instantly kills a stolen token while letting the real user back in. Deleting the account is destructive and slow; "waiting for proof" lets the attacker keep working.
Step 3: Scope the blast radius
Once contained, investigate what the suspicious session did: inbox rules created (a top BEC signal), OAuth grants, downloads, and privilege changes. Impossible travel is often the first visible step of a longer intrusion.
The mindset
Prioritize by impact and asset value, act to contain quickly and reversibly, then scope. Speed matters - but so does not paging the whole company for a sales rep on a VPN.