How to properly track and handle user authorization?

Question

User identification

Interested in algorithms for protecting against account hijacking by accounting and checking atypical locations from which an authorization attempt is made.
The approximate procedure is clear. You log the authorization facts, check the location, if you are, for example, in another country, then we ask you to confirm your authenticity (via SMS, etc.)
But maybe someone will share links to sensible manuals and articles on this topic? Googled - didn't find it