The ORS allows three unsuccessful attempts before a User’s account is disabled.