Starting in 1.68.0, FusionAuth uses a variety of "Risk Signals" to determine when to trigger the Suspicious Login email. The email is sent whenever any enabled risk signal returns a HIGH value. One common signal that can cause this is:

• DormantPassword: This signal triggers when a user's password hasn't been changed "in the last few months." If your users do not regularly rotate their passwords, this risk signal could be flagging every login as suspicious.

Solution

You can fine-tune which Risk Signals are considered for your tenant:

1. Navigate to Tenants > Edit Tenant > Security > Customize Risk Signals
2. Review the enabled risk signals
3. Consider toggling off the Dormant Password signal if password rotation is not part of your security model, or adjust other signals as appropriate for your use case

Testing

To verify this is the cause:

• Try changing a user's password, then logging in again to see if the suspicious login email still triggers
• Alternatively, disable the Dormant Password risk signal temporarily and test login behavior

This should allow you to re-enable suspicious login notifications while avoiding false positives for normal login activity.