Protect remote workers against account takeovers