Methods and techniques to protect against shoulder surfing and phishing attacks