[kissiel]

maybe to detect that the valid credentials are leaked / used in the wilds?

[Cthulhu_]

Exactly; a valid login attempt from abroad should trigger an immediate account lock and credentials reset for sensitive systems like this.