They should treat logins from a different part of the world differently. One should be able to register their devices all at once. Allow the attacker to login but not to a real account and then use the opportunity to trace the offender.
Oooh, I like this idea. Kind of a honeypot?
Yup, insects need to fly to the light. You let them login to something , give them pretend transactions and find out the destinations and the actors and many institutions can use the same processing facility to correlate them