“But in the event of a login request that looks risky to us, the standard notification will not be sent to the user.”