# Suspicious Account Activity

## Casa's suspicious account activity alerts you when a login to your account comes from a location that would be physically impossible to reach since your last one. For example, if you logged in from Denver and a new login appears from Tokyo twenty minutes later.

**Why this matters**  
Account compromise is a common first step in social engineering attacks. Suspicious Account Activity gives you early warning that someone else may have accessed your account before any further action can be taken. As a reminder, Casa will never call you or log into your account.

**How it works**  
1. When you log in, Casa records your login location at the city level.  
2. If a subsequent login comes from a location that would be physically impossible to reach in the elapsed time, Casa sends you an alert.  
3. You can review your recent login activity in **Settings > Security > Remove Alert**.

**Is Suspicious Account Activity on by default?**  
No. You can enable it in **Settings > Security > Remove Alert**.

**What should I do if I receive an alert?**  
1. Do not dismiss the alert without investigating.  
2. Check your recent login activity in the app.  
3. If you don't recognize the login, contact Casa Support immediately at [help@team.casa](mailto:help@team.casa).  
4. Change your account password and review any recent account activity.

**Will the alert tell me where the login came from?**  
Yes, the alert will show you approximately where the other login originated.

**What if the alert was triggered by a VPN?**  
VPNs can occasionally trigger false positives. If you're using a VPN:  
1. Temporarily disable your VPN.  
2. Log in to your Casa account again.  
3. Dismiss the alert in **Settings > Security > Remove Alert**.  
4. Re-enable your VPN.

If you were not using a VPN when you received this alert, contact Casa Support at [help@team.casa](mailto:help@team.casa) immediately.