Six wrong attempts locks the account for five minutes. Every sign-in is written to the audit trail with time, address and device.