After your password, a 6-digit code is emailed to you. Five wrong attempts lock the account for 15 minutes.