If you check the security events/analytics page, you should be able to see the reason.