Protection against brute-force attacks that target a single user account.

The following steps are followed:

• Lock the account temporarily if there are a number of consecutive failed  

logins on an account (e.g, 10) 

• Send an email to the registered owner of the account indicating that the  

account has been locked out due to the multiple failed login attempts. 

• Present a generic error to the user.

If a user enters their password incorrectly 10 or more times they get an email like the one below requesting them to Unblock their account.