I am trying to build correlation/ potential red flag rules to detect if passwords are being shared or stolen... the primary driver for this is guidance from our compliance team, that much of our frauds in payments have arisen because of deliberate sharing or theft of a co-workers credentials (e.g. in maker checker etc). I was asked to look at a data-centric approach to solve this

some thoughts include
a) password being used at 2 IP addresses that area physically far from each other
b) software application being accessed without physical access swipe record (that would indicate entry into work area)

Any thoughts/ guidance around how to build a comprehensive list of flagging suspects here