Geo-based analysis for detecting abnormal logins

At a computer system including at least one processor, a computer-implemented method for evaluating the acceptability of a received communication, the method comprising:

• receiving a communication from a user's electronic device at a specified time, the communication including identification information that identifies the electronic device, the electronic device being associated with the user and the time of communication;
• accessing location information that identifies the current location of the electronic device;
• accessing a generated reachability score indicating the probability that the electronic device's current location was reachable based on the location of the electronic device's last communication;
• comparing the location from which the communication was received to the probability indicated by the reachability score to determine whether the communication's location is acceptable;
• and
• if the probability indicated by the comparison is below a threshold level, indicating that the communication is suspicious.

A computer system comprising the following:

• one or more processors;
• one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, cause the computing system to perform a method for establishing an acceptability model to determine the acceptability of a communication originating from a specified location, the method comprising the following:
• accessing a login history for an electronic device, the login history including at least one previous login attempt between the electronic device and a computer system;
• accessing an updateable listing of locations from which login attempts may be received from the electronic device;
• receiving at least one subsequent login attempt from the electronic device;
• and
• determining the acceptability of the subsequent login attempt from the electronic device based on the login history and one or more login histories for electronic devices similar to the electronic device.