What is location factor authentication (LFA)?

Location factor authentication adds physical location to a sign-in as an authentication factor: a challenge goes to an enrolled device, which returns a signed verdict about the region it is in, without disclosing a position.

Location as a factor

Authentication factors are usually described as something you know (a password), something you have (a phone or key) and something you are (a fingerprint). Location adds a fourth: somewhere you are. It lets an organisation require that a sign-in or an approval happens only while the user’s enrolled phone is in a permitted place, such as a country or an office.

How it works when the login is not on the phone

Most sign-ins that matter happen on a laptop or through an API. LFA covers them by binding the location check to the session. The identity provider sends a challenge to the user’s enrolled phone. The phone answers with a signed verdict that it is inside the permitted region, tied to that challenge and that session, so the answer cannot be replayed into a different login.

Octet LFA is an authenticator app plus an OpenID Connect provider, so it plugs into identity systems that already speak OIDC. Policy sets whether a check runs passively, with no prompt, or asks the user to tap the app to prove their location. See the LFA docs.

Where it is used

• Account takeover. Policy can require a QR scan at each sign-in. A stolen password used from another computer then fails unless the attacker gets the real user to scan the attacker’s screen.
• Location policy. Staff can sign in only while their enrolled phone is in a permitted country. A user who travels outside it fails the factor until they return.
• Wire approval. A high-value transfer can require that the approver’s enrolled device is in a permitted place at the moment of approval.
• Invoice and payment-change fraud. A request to change bank details can require a location proof from the supplier’s enrolled device, not only an email.

Last reviewed 19 October 2026