What is the actual point of having stolen credentials like usernames and passwords if we don't know the original location/ip address. Because if you try to log in with those credentials from another location the system will flag you and ask for more verification from either a phone or email.