What is impossible travel?
Impossible travel is a behavioral indicator in which one account signs in from two locations so far apart that no person could have moved between them in the time that passed. If an account authenticates from Dallas and then from Singapore forty-seven minutes later, no flight covers that gap, so either two people are using the account or the credentials and session were stolen. It is one of the clearest signs of an identity compromise, and many cloud identity platforms flag it automatically.
How it is detected
Detection compares the geolocation of each sign-in, derived from its source IP address, against the time between the events and a plausible travel speed. A sign-in log makes the pattern obvious. Two successful logons for one user, in two countries, within an hour, is the shape to recognize:
14:02 user=rkhan success ip=198.51.100.20 geo=Dallas, US
14:49 user=rkhan success ip=203.0.113.88 geo=Singapore, SG
Both logons succeeded, and both may even have passed multifactor authentication, which tells you the attacker holds more than a password: perhaps a stolen session token or an approval obtained by social engineering. The impossibility is in the geography and the clock, not in the strength of the login itself.
False positives to rule out
The common benign explanation is a VPN or corporate proxy. An employee's traffic can egress from a data center far from where they are sitting, which looks like a sudden jump in location. Analysts tune the rule to ignore known VPN and proxy ranges before they alert on it. Cloud sync clients and mail apps checking in from a provider's region can also trip it. Absent one of those explanations, two successful sign-ins too far apart to be one traveler is treated as a compromise.
How to respond and prevent it
The immediate response is to revoke the account's active sessions and force re-authentication, then review what the second session did. Conditional access policies prevent much of this by blocking or step-up challenging sign-ins from unexpected countries, untrusted devices or risky IP addresses. Phishing-resistant MFA reduces the odds that an attacker ever reaches a successful second login.
Impossible travel vs. concurrent sessions
The two look similar and often describe the same incident from different angles. Impossible travel is sequential: one sign-in follows the other, and the distance between them is the tell. Concurrent sessions are simultaneous: the same account is actively used from two places at the same moment, which one traveler cannot do either. If the scenario stresses two logons separated by a short time and a long distance, the term is impossible travel.
Impossible travel on the CompTIA Security+ exam
Impossible travel is taught as an indicator of malicious activity under objective 2.5, where a scenario gives you a sign-in log and asks you to name what it shows. It also appears in alerting and monitoring under objective 4.4 as a standard SIEM correlation rule. Wording such as a user signing in from two distant locations within minutes, or a logon from a country where no employee is located, points at impossible travel. The distractors are a brute-force attack, which shows many failures against one account, and simple account compromise; the exam wants the specific name for the geography-and-time pattern, plus the response of revoking sessions and forcing re-authentication.