The IP-based approach seems flawed from my pov as someone who travels often. I'm always checking in from various IP addresses. Even locals who like to log in from the nearest cafe would get false positives, while the canary approach is more targeted.