Accounts lock for 15 minutes after 5 failed attempts.