when I sign in to my apple id, I get a notification but it shows a wrong location.

That is because those 2 features use 2 different technologies.

The 2FA uses the geographic data provided by the ISP.

The "Find My ..." feature on iCloud.com uses location services data provided by your device to be so accurate.

Same issue here - including when I signed in to this site using 2-step ID! I'm told a log-in has taken place in Edinburgh, Scotland... I'm in Hampshire, England, almost 500 miles away! Does this mean that if I need to trace my computer (or other devices) using Find My Iphone (etc) it won't work?

Not in Sydney where Apple thinks it is.

So again, Apple was told by your ISP that's where you are. GIGO.

Ironically, I went to reply and was asked to sign in. When I signed in, I got a pop-up saying someone is using my account in a town about 80 miles away, and asked if I am okay with that. I said I am. It gave me a code that I should enter to authorize. Another window asked me to enter the code I'd been sent.

How is that two-factor authorization if the authorization code is being sent to the laptop that is asking for the code?

Anyway, to answer your question; it sort of depends on your definition of "figured out." I think we've figured out that when you sign in your Apple account, you might get a warning that someone is trying to sign in near X location. That location may or may not be near your actual location. Since the time frame aligns with your using your password even though the location does not, it is probably safe to allow the access and ignore the warning.

To keep your account double extra secure, Apple might also demand a 6-digit code which they will helpfully send to the device that you're using. Transferring it from the one box to the other on your screen should help you feel more secure. I think that's what we've figured out.

I should note there are some on this thread who will argue that Apple does not have an issue, that all of this is the fault of you, your ISP, your phone company or defective satellites. Or something. I'm sure they are right.

Absolutely! this has just happened to me as I tried to get my new 2 stage verification process set up on ApplePay using my iPad equipped with mobile data from giffgaff. The message pinpointed Middlesbrough again.

There's nothing designed to make you panic more than to get a message that someone the other side of the country is borrowing your Apple ID when you are setting up a payment mechanism! So I immediately changed my password and tried again. The same thing happened and this time I didn't see any point in changing my password. If someone was on to me so soon after changing it the first time they'd just get it again even if I changed it. However I then found that my new password was not being accepted on another device and neither was my old one, so I was locked out. Fortunately I then managed to find this thread and tried to set up ApplePay again. When I ignored the mysterious person from Middlesborough my PIN number came through and I was able to proceed,

We are taught these days to be very wary of anything suspicious going on on our devices! We should NEVER be put in a position where the only way ahead is to ignore security messages, especially when trying to set up anything to do with money! What's to stop a real hacker who actually happens to be from Middlesborough from sending similar messages to those whose ID they are trying to steal? We can't now just dismiss anything from Middlesborough as being safe!

The issue has corrected itself for me. I believe the problem was down to the ISP as the location was always wrong in the house but had a different answer outside it.

I have the same problem. Only when signing in to my Apple ID. My iPhone knows that I am in Washington state (in the Maps program, for example), but it notifies me that someone is trying to sign into my account in Arizona. Why does it think I am a thousand miles away? Perhaps it has something to do with the WiFi in my house, which is a satellite-based service. It's annoying in any case, because it acts like an impostor is trying to sign into my account. Based on the timing, I know it's ME.

More of the same here. I'm in Adelaide but the two-factor authentication on my Mac Book Air thinks I am in Sydney. OK I understand about the approximate location based on IP thing but if I go into icloud.com and ask where my Mac Book Air is it knows the house it's in.

I discovered it's easier to use the Maps application to see where I am. Launch Maps and choose View > Select Current Location. It knows where I am. So why doesn't Apple know where I am ? Perhaps it doesn't use the location the MacBook tells it in case someone is spoofing that somehow ?

Thanks. Yes I guess 2FA is not using the location services data from the MacBook. Interestingly though when I search my IP online (Geo IP Lookup) I am told it is in Adelaide. Not in Sydney where Apple thinks it is.

How on earth can you just say that? I use APPLE location services that locate me in Google Maps, Taxi services, and the list goes on. It is most certainly an APPLE issue. I am sick to death of the circular, repetetive and absolutely impenetrable authentication process throughout the iOS system. You can't defend the indefensible!

To be confronted with such recursive gyrations and difficulties when making a simple password change or setting up an application specific password -- only to be confronted with a map that shows you thousands of miles from your current location -- overlaying the 6-digit code you need in order to continue is just plain poor programming. Slack.

Security is absolutely vital, no question, but as someone who has no small experience implementing security for systems in the utilities sector, to make the process so mind-numbingly circuitous and error-prone as Apple's is to invite laxity on the part of users. Words fail.

One would think this is not beypond the capacity of Apple to explain given the number of enquiries it has generated. Hope this helps..

Like this? >> Two-factor authentication for Apple ID - Apple Support

It's got nothing to do with the ISP. Apple's system is either broken or badly designed.

The location offered is based on where the ISP has said that IP address is located.

You can dispute this if you wish, but that is the truth. Apple certainly can, but does not leverage the GPS chip in a device for this notification, only the ISP provided location based on the IP address.

This is published by Apple, and was referenced just 3 entries back in this thread.

Two-factor authentication for Apple ID - Apple Support

Before you label me an Apple fanboy or attach some other derogatory label to me, this has been proven to be true throughout North America, and I see no reason why the UK would be different. ISPs do not reference leased IP addresses to the house and street level. They keep them by blocks and by cities. That UK ISPs may be less "accurate" then others is moot.

Even worse, sometimes Apple are sending the verification code to the device on which I'm actually trying to make the access to an Apple service that requires sign in.

This statement demonstrates you don't understand how 2 Factor Authentication is designed to work. It is designed to work with a single device. A trusted phone is all you need. If you know both the password for an Apple ID, and can then successfully enter the 6 digit verification code sent to a trusted device associated with that Apple ID, it is assumed you are the rightful account holder. The first factor is the password, the second is the verification code.

If a thief has your phone, it is your strong passcode that prevents them from accessing your account, not 2FA. Using your logic, the use of 2FA would require 2 Apple devices. You can have multiple trusted devices, but 2FA will work perfectly with just one. That's why the code comes to the device you trying to access.

2FA protects your Apple account, not your physical phone. A strong passcode protects your phone, not your account.

If a passerby grabs your phone, they should be blocked from getting to the 2FA stage by the strong passcode.

Yes. I am using BT broadband. Is it related to the issue?

I'm in Port Elizabeth, but my location shows Johannesburg when I log onto iCloud.