Require a user PIN before sensitive confirmations and validations
Track failed logins, alert admins, and block attacking IP addresses.