Abstract: The present disclosure relates to a method for identifying unauthorized access of an account of an online service, such as an email or a social network service, wherein the account is associated with a legitimate user, the method comprising the steps of: retrieving login information from recent login activity of the account corresponding to a geographic location associated with the ongoing or most recent login attempt; retrieving usage information comprising a geographic location of a legitimate user from a device of the legitimate user; comparing the login information and the usage information by comparing the geographic location associated with the ongoing or most recent login attempt and the geographic location of a legitimate user; and identifying potentially unauthorized login(s) by an unauthorized user.