Max 5 attempts before lockout (15 min).