I don't know how possible this will be, but to help increase security to the members, I'd make it mandatory to either have a code sent to their cell phone or activate 2FA and enter a code for signing in.