After 5 failed attempts the account is locked for 15 minutes.