Your Page Title
English (United States)
Community

Articles in this section

Suspicious Login Challenge

Avatar
Product Team
  • Updated
  • ~ minute read

What It Is

Suspicious Login Challenge adds an extra layer of security to protect your Apaleo account from unauthorized access and account takeovers.

When Apaleo detects a login that appears unusual, for example, from a new device, location, or browser, the user will be redirected to a page informing them that identity verification is required. After clicking the button, they will receive an email asking them to confirm it’s really them before continuing.

How It Works

When a login attempt appears suspicious, Apaleo sends a secure, one-time verification link to the user’s registered email address.

Clicking this link confirms the user’s identity and completes the login process safely.

Apaleo’s fraud detection technology evaluates multiple signals, including:

  • Device characteristics (e.g., browser type, timezone, and screen details)
  • Login patterns such as location, time, and frequency
  • Known threat sources and compromised networks

Based on this analysis, the system determines whether to:

  • Allow the login (low risk)
  • Request verification (medium risk)

Key Benefits

  • Protects against unauthorized access — even if credentials are compromised
  • Stops automated credential-stuffing attacks
  • Detects risky behavior intelligently to reduce false alarms
  • Adds phishing-resistant verification for safer access

How To Enable

Only Account Administrators can enable or disable the Suspicious Login Challenge.

  1. Go to Account settings → User Management → Access settings
  2. Find the section Suspicious login detection
  3. Toggle on Enable challenge on suspicious login detection
  4. Save your changes

Suspicious Login Challenge Settings

Notes:

  • The feature is disabled by default.
  • Once enabled, it applies to all users on the account.

Before You Enable

Consider the following points before activating this feature:

Email Access

  • Some users might not have access to their inbox from shared or work devices.
  • Verification links must be opened on the same device and in the same browser where the login was initiated.

Workflow Impact

  • Under normal circumstances, users shouldn’t notice any change in their login experience.
  • The challenge appears only when a login seems unusual or potentially risky, helping to protect accounts from unauthorized access.
  • In rare cases, legitimate users may also be asked to verify their identity if their login looks unfamiliar to the system.
  • The verification step adds only a brief delay to the login process when triggered.

Troubleshooting

Didn’t receive the verification email?

  • Check your spam or junk folder.
  • Make sure your email address in Apaleo is correct.
  • Wait a few minutes or try logging in again.

Verification link isn’t working?

  • Open the link on the same device where you started the login.
  • Ensure it hasn’t expired or been used already.
  • Try copying and pasting the link into your browser.

Getting challenged often?

  • Avoid using VPNs when possible.
  • Use the same browser and device consistently.

Security Details

  • Time-limited: Verification links expire after 5 minutes.
  • Single-use: Each link can only be used once.
  • Device-aware: Verification must be completed on the same device where the login started.
  • IP-bound: Each verification link is tied to the network where the login began.

Related articles