Yes, San.. I think you should make users to type in security digits/numbers before logging in to prevent fraud, and i m sure you are capturing IP addresses.