The invention relates to a login abnormity detection method, system and device. The login abnormity detection method comprises steps of obtaining login data of a user history preset time interval, generating a login abnormity index based on at least two dimensions of a time node, a time type, a city that a login IP belongs to, two place login speeds, a time interval between two login times and times of trying to login according to the login data, wherein at least one of the dimensions of the login time node, the time type and the city where the login IP belongs to exists, obtaining new login data and generating an abnormal score by combining with a newest login data dimension and a login abnormal index corresponding to the dimension. Multi-dimension aggregation solves a problem of one-dimension misinformation. The login abnormity detection method, system and device can overcome current dimension deficiency through more dimension detection, improve abnormal login hit rate, screen out high score data to investigate through grading the login data according to weights / and abnormity detection algorithm and can fundamentally eliminate misdetection and leak detection of login through combining multiple detection modes.