Security policy: 2 incorrect attempts trigger email verification; 5 trigger a 30-minute pause; 10 incorrect attempts in one day lock the account.