Freshworks automatically detects login attempts from unfamiliar locations during password-based sign-in and requires email verification before granting access. This protection applies even when multi-factor authentication (MFA) is not mandated for your organization.

You do not need to configure suspicious login detection. It is enabled automatically for Freshworks accounts.

Note for end users: If you received a verification email and need step-by-step help, see How to verify an unusual login attempt.

TABLE OF CONTENTS

• Overview
• How suspicious login detection works
• What users experience
• Enterprise security controls
• Frequently asked questions
• More resources

Overview

Suspicious login detection helps protect accounts from unauthorized access when credentials are compromised. Attackers often sign in from locations that differ from a user's normal login pattern. This feature evaluates each login in real time and adds verification only when the login appears high-risk.

Key features:

• Adaptive protection: Additional verification is required only for high-risk logins.

• Minimal friction: Familiar login locations proceed without extra steps.

• Automatic coverage: Protection applies to users who do not have mandatory MFA enabled.

• Security notifications: Users receive a location-aware email when verification is required.

When verification is required

Verification is required when:

• A user logs in from a location not found in their recent login history.

• MFA is not already mandated for that user or organization.

Verification is not required when:

• The login location matches one of the user's recent locations.

• The user is logging in for the first time and has no login history yet.

• MFA is already mandated for the user or organization.

How suspicious login detection works

During each login, Freshworks evaluates risk using location-based behavioral intelligence. The process follows an industry-standard continuous verification approach.

Login evaluation flow

1. Credential validation: The user submits their credentials and Freshworks validates them.

2. MFA mandate check: Freshworks checks whether MFA is already required for the user or organization.

   • If MFA is mandated, the standard MFA flow applies and suspicious login detection is skipped.

3. Suspicious login detection: If MFA is not mandated, Freshworks:

   • Resolves the login location from the user's IP address.

   • Compares the current location against the user's last five unique login locations.

   • Assigns a risk level based on whether the location is recognized.

4. Login decision

   • Low risk: The login proceeds normally.

   • High risk: The user must verify the login with an email one-time password (OTP) before access is granted.

Important: Suspicious login detection runs only when MFA is not already mandated for the login.

Location detection

Freshworks uses country- and state-level location data to evaluate login risk. This granularity reduces false positives caused by legitimate travel or VPN usage.

How the system learns over time

Freshworks stores a user's last five unique login locations. Locations that appear regularly in a user's history, such as offices or frequent travel destinations, are treated as familiar over time. Only genuinely new locations trigger verification.

What users experience

When a suspicious login is detected, the user receives an email with the subject Unusual Login Attempt Detected - Verify Your Account.

The email includes:

Important: When suspicious login detection is triggered, Freshworks always sends an email OTP, even if the user has TOTP or SMS MFA configured. This ensures the user receives a security notification at their registered email address.

After the user enters the verification code, login completes normally.

Enterprise security controls

Freshworks designed suspicious login detection with enterprise security requirements in mind.

Frequently asked questions
How does suspicious login detection interact with existing MFA configurations (TOTP, SMS)?

Suspicious login detection always triggers email OTP, regardless of the user's configured MFA method. This ensures consistent security notifications for suspicious logins.

If MFA is already mandated for the user or organization, the standard MFA flow applies and suspicious login detection is skipped.

What geographic granularity is used for location detection?

Freshworks uses country and state level detection, not city level, to reduce false positives from legitimate travel and VPN usage.

How are new users or users with no login history handled?

Suspicious login detection is skipped for users with no login history. After the first successful login, Freshworks establishes a baseline location pattern and begins detection on subsequent logins.

What happens if Geo-IP resolution fails or the detection service is unavailable?

Freshworks uses a fail-open design. Login proceeds normally, and failures are logged for monitoring. This prioritizes availability for legitimate users.

How does the system handle frequent business travelers?

Freshworks learns user patterns over time. Regular travel locations become part of the user's historical pattern (last five unique locations). Only genuinely new locations trigger MFA challenges.

Can customers disable suspicious login detection for their organization?

Yes. Organizations can request that suspicious login detection be disabled. This is configured through backend settings and is not available in the admin UI. Contact Freshworks support to enable or disable the feature.

More resources

• How can I enable/disable two-factor authentication?
• How can an organization admin enforce 2FA as a policy for all or some users in the organization?
• Mandatory two-factor authentication for Freshworks org admins
• How to verify an unusual login attempt