I was about to link this story back to Path of Exile folks given what's happened there. When I saw your post, I looked at your profile - nice that you're here!
For what it's worth, you should consider locking not on attempt to log in, but on successful login from abroad. This was an old problem in some Windows networks: accounts would be locked with 5 failed logins. People discovered they could lock out friends' accounts (or ahem the president's) by failing a login 5 times.
(P.S. If anyone's looking for a great way to waste more time than they should, Path of Exile is a pretty great game.)
For what it's worth, you should consider locking not on attempt to log in, but on successful login from abroad. This was an old problem in some Windows networks: accounts would be locked with 5 failed logins. People discovered they could lock out friends' accounts (or ahem the president's) by failing a login 5 times.
(P.S. If anyone's looking for a great way to waste more time than they should, Path of Exile is a pretty great game.)