To help detect account compromises and locking out accounts that have been compromised rather than sending an escalation and leaving the account open to be abused by threat actors.