Impossible travel is a sign-in anomaly in which the same account appears to authenticate from two distant locations within a time window that would be physically impossible. Security platforms usually infer this from IP geolocation, device telemetry, and login timestamps. For example, a user may seem to sign in from one country and then minutes later from another continent.
This matters because it often indicates stolen credentials, session replay, proxy use, or an attacker operating through a cloud host or VPN. By itself, impossible travel is not proof of compromise: geolocation can be inaccurate, mobile networks can shift, and shared corporate egress points can blur location. But as a detection signal, it is valuable when combined with other indicators such as new devices, unusual MFA prompts, atypical access times, or access to sensitive resources. Defenders use it to trigger step-up authentication, revoke sessions, and investigate whether a legitimate account has been hijacked.