Accounts detected with 2+ devices/IPs active at the same time in the last scan. Detection only — nothing here blocks a login.