Your firm set up SSO (Single Sign On), along with a PIV access card (βsmartcardβ) per employee as its method for dual-factor authentication and building access during COVID. The company has recently set a policy of minimum 3-day RTO (Return To Office) per week policy.
Recently, there has been a rise in suspicious office logins β both at unusual times and by users that were working from home. List no less than 3 possibilities and describe as to why this could be happening.