I usually log in from one city in Germany, now I suddenly log in first from another city in Germany. It's the same user agent, but an empty cookie jar. Should t

I usually log in from one city in Germany, now I suddenly log in first from another city in Germany. It's the same user agent, but an empty cookie jar. Should the login be denied? Now I log in from a city in the Netherlands, 20 minutes later. From a phone, again, empty cookie jar. Even with a helicopter there's no way to make it there that fast. Should the login be denied? (The answer is "no, because I've traveled to another city to visit a conference, and the conference network was routed in a weird way and the GeoIP data for their exit IP was incorrect".) People jump locations all the time, for reasons like remote desktop sessions, mobile roaming, personal and company VPNs, etc. Locking out a real user has a significant cost.