You can implement a basic level of this just by storing some information about users and then comparing it on login. Some relatively simple examples - Inform

You can implement a basic level of this just by storing some information about users and then comparing it on login. Some relatively simple examples - Inform users of unsuccessful login attempts since their last sign-in. This can let them know if someone is trying to attack their account. - Notify the user if they login from a new browser. You can record information about the client (user agent plus other identifiers that are visible server-side) and then notify the user when connections are made from new systems that haven't been seen before. - For GeoIP there are basic datasets that cover things like country of origin that are generally available for free. You could use one of those to note the customers general country of origin and then notify when that changes. None of these are flawless of course, but they could provide some basic means to help users protect their accounts.