Track failed logins, alert admins, and block attacking IP addresses.
Require a user PIN before sensitive confirmations and validations