It becomes a pain vs gain problem. How hard do you make it, also balancing the inconvenience.
You could easily force users to enter a one time code via email every 3 months (or more or less time). This would be hard to automate and if you changed it up even more so.