Design strategies for preventing fraudulent logins across multiple sites