Account Shows Sessions From Multiple Locations – What's Happening?

When This Shows Up

You log into your account (could be Google, Microsoft, a bank, or a business app like Slack or Salesforce) and you see active sessions from New York, Los Angeles, and maybe Frankfurt. You haven't been to any of those places. The timestamp? Two hours ago. You're sitting at your desk in Chicago.

This happened to a client last month. She panicked, thought her account was hacked, and started resetting everything. Turned out it was just her VPN bouncing between servers. But sometimes it's not that innocent. Let me walk you through what's really going on.

Root Cause – It's Usually a Token Or Cache Issue

Most modern apps don't keep your session tied to one IP address. They use session tokens – a piece of data stored in your browser or app. If your internet provider uses a shared IP (like CGNAT), or you use a VPN, or your phone switches between Wi-Fi and mobile data, the server sees different IPs for the same token. That's why you see multiple locations.

Another common cause: you left a browser tab open at work, and another at home. The app sees both as active sessions with different IPs. Unless you force a logout everywhere, those sessions stay alive for hours or even days.

Rare but real: someone actually stole your token. This happens if you logged into a public Wi-Fi without HTTPS (unlikely these days) or if you installed a browser extension that grabs cookies.

The Fix – Step by Step

1. Force logout of all sessions. Go to your account security settings. Look for 'Sign out of all devices' or 'Revoke all sessions'. Do that. This kills every token everywhere, including any hijacked ones.
2. Change your password. Pick a long one – at least 16 characters. Don't reuse one from another site. Write it down on paper if you must. Password managers are fine, but don't store it in a browser.
3. Enable multi-factor authentication (MFA). Use an authenticator app like Google Authenticator or Authy, not SMS. SMS is better than nothing, but it can be intercepted. Push-based MFA (like Microsoft Authenticator) is also good. This stops token theft cold.
4. Check your VPN and IP setup. If you use a VPN, note that it can show locations far from you. That's normal. If you don't want that, disconnect the VPN or set it to a nearby server. Also check if your ISP uses CGNAT – if they do, your IP can change mid-session.
5. Review third-party apps and extensions. In your account settings, look for 'Connected apps' or 'Authorized apps'. Remove anything you don't recognize. Browser extensions should be limited – I only use uBlock Origin and a password manager.
6. Clear browser cache and cookies. This forces your browser to request fresh tokens. Do this in every browser you use. On Chrome: Settings -> Privacy and security -> Clear browsing data -> Cookies and other site data.

If It Still Happens

You've done the steps above, but you still see sessions from random locations. Here's what to check next:

• Check login history. Most accounts have a 'Recent activity' page. Look for logins with a different operating system or browser version. If you see 'Windows 10 / Chrome 120' and you only use 'macOS / Safari', that's suspicious.
• Check for session duration settings. Some apps have a session timeout option. Set it to 1 hour or less. This forces the app to ask you to re-authenticate more often, which reduces the window for token misuse.
• Is it a shared account? If this is a business account used by a team (like a shared social media login or a shared email), multiple locations are expected. Set up individual logins instead.
• Contact support. If you've ruled out the above and still see unexplained sessions, talk to the app's security team. They can check if the session token was used from a different device fingerprint.

One last thing – don't rely on IP geolocation alone to decide if you're hacked. Lots of legit things cause mismatches. Focus on the token and MFA. That's where the real security lives.