A computer-implemented method performed by an online system, comprising: determining, for an account of a user of the online system, that the user must provide a first credential type before a second credential type in order to obtain access to the account; receiving, from an accessing user, a request to login to the account, the request including a value of the first credential type; and characterised in that: based at least in part on the value, determining that the request is likely unauthorized; and responsive to determining that the request is likely unauthorized: determining that the accessing user must provide the second credential type before the first credential type in order to obtain access to the account; determining that requests from a second accessing user to login to an account of a second user of the online system are likely unauthorized; and responsive to determining that the requests are likely unauthorized: logging information about the requests to login, the information comprising credential values submitted along with the requests from the second accessing user; identifying, as common credential values, ones of the credential values submitted with at least a threshold frequency; receiving a request from a user to change a credential value of the user to one of the identified common credential values; and rejecting the request of the user to change the credential value of the user to the one of the identified common credential values. determining, for an account of a user of the online system, that the user must provide a first credential type before a second credential type in order to obtain access to the account; receiving, from an accessing user, a request to login to the account, the request including a value of the first credential type; and characterised in that: based at least in part on the value, determining that the request is likely unauthorized; and responsive to determining that the request is likely unauthorized: determining that the accessing user must provide the second credential type before the first credential type in order to obtain access to the account; determining that requests from a second accessing user to login to an account of a second user of the online system are likely unauthorized; and responsive to determining that the requests are likely unauthorized: logging information about the requests to login, the information comprising credential values submitted along with the requests from the second accessing user; identifying, as common credential values, ones of the credential values submitted with at least a threshold frequency; receiving a request from a user to change a credential value of the user to one of the identified common credential values; and rejecting the request of the user to change the credential value of the user to the one of the identified common credential values. based at least in part on the value, determining that the request is likely unauthorized; and responsive to determining that the request is likely unauthorized: determining that the accessing user must provide the second credential type before the first credential type in order to obtain access to the account; determining that requests from a second accessing user to login to an account of a second user of the online system are likely unauthorized; and responsive to determining that the requests are likely unauthorized: logging information about the requests to login, the information comprising credential values submitted along with the requests from the second accessing user; identifying, as common credential values, ones of the credential values submitted with at least a threshold frequency; receiving a request from a user to change a credential value of the user to one of the identified common credential values; and rejecting the request of the user to change the credential value of the user to the one of the identified common credential values.