An operation request is received from a terminal device. An identification of the terminal device is determined. Based on the identification of the terminal device, historical operation requests initiated from the terminal device in a predetermined time period prior to the operation request are determined. A user identity location is determined for each historical operation request. A number of different user identity locations for the historical operation requests is determined. Based on the number of different user identity locations, an account theft risk value is determined.