---
title: Impossible travel
description: Impossible travel is two access events for the same user separated by a distance and time that no real human could bridge, a strong indicator of both account takeover and account sharing.
---

# Impossible travel

Impossible travel is two access events for the same user separated by a distance and time that no real human could bridge. It's a strong indicator of both [account takeover](/docs/v3/concepts/account-takeover) and [account sharing](/docs/v3/concepts/account-sharing): one person can't physically be in two places at once, so a session in São Paulo immediately followed by a session in Berlin is somebody else.


## How Rupt computes it

For each [evaluation](/docs/v3/concepts/evaluations), Rupt compares the current geolocation against the user's most recent access and checks two conditions:

- **Distance**: ≥ 500 km between the two locations, AND
- **Required speed**: ≥ 1000 km/h to bridge them in the elapsed time.

The window is 48 hours. Older sessions don't trigger the check, since enough time has passed that genuine travel becomes plausible. Both conditions must hold: a 600 km gap over a full day fails the speed check, and a fast turnaround across a small distance fails the distance check.

## Using it

`impossible_travel` is exposed as a [check](/docs/v3/concepts/checks) and weights into both the [account takeover](/docs/v3/concepts/account-takeover) and [account sharing](/docs/v3/concepts/account-sharing) risk scores. To act on it in a policy, match the check directly:

> If `event_type = login` AND `impossible_travel = true` → `challenge`.

## Pairs well with

- **[Concurrency](/docs/v3/concepts/concurrency)**: if both flip true on the same evaluation, sharing is essentially confirmed.
- **VPN / proxy / Tor flags**: impossible travel through an anonymizer is a near-certain ATO indicator.
- **New [fingerprint](/docs/v3/concepts/fingerprints)**: the geographic shift is more meaningful when the device looks new for the account too.

## Edge cases

- **Genuine air travel.** Long-haul flights cover impossible-travel distances in plausible time and won't trigger the check (1000 km/h is faster than commercial aviation cruise speed). Short-haul or layover patterns also pass because the distance threshold isn't met.
- **VPNs that flip locations.** A user toggling a VPN can technically trigger impossible travel even when they aren't moving. The IP anonymity flags are factored in, so [policies](/docs/v3/concepts/policies) can decide whether to treat VPN-driven impossible travel as the same severity as physical impossible travel.