Five wrong attempts lock the account for 15 minutes. Every sign-in is recorded.