Lol of course there is.
1: IP alerts - new IP? email alert.
2: 2FA - should be standard, requiring a physical device to login
3: Deterrents; seems slightly fishy? You need to login to the account by proving you are the owner.
With AI it's not so difficult to detect if it's a genuine login (browser fingerprinting, UA strings, version numbers, OS versions etc).
I always think about people who say that verification keys in emails is the route to go[0] to stop phishing/fraud attempts. It's a technological method that ensures the message is sent from a specific source, but that doesn't mean that the user will always verify the key.
We've had the technology to stop most commonplace security issues for a while. We've almost always been lacking in culture.
If these same people had the obstacle of having to add another person's phone to 2FA as well as share the password, they still wouldn't look very long at alternatives to the way they log in. There's a fundamental assumption that there's a way to log in, and other people just have to do that. Very hard to help them realize that everyone should authenticate as individuals, and you can authorize individuals to access the group's resources.
The simplest defense is to never log the user out and only ask passwords for special things (like Github's Superuser Mode)