1. A non-transitory computer-readable storage medium having stored thereon program instructions that are computer-executable to perform operations comprising: receiving, at a computer system, a user identifier and an authentication code, wherein the user identifier specifies a user, and wherein the authentication code is to replace a current authentication code used to authenticate the user and, in the event that the authentication code is successfully established, will replace the current authentication code such that the authentication code will authenticate the user and the current authentication code will no longer authenticate the user; retrieving, by the computer system, an authentication code preference model for the user identifier from a database, wherein the authentication code preference model is provided from an entry in the database that corresponds to the user identifier, and wherein the authentication code preference model was previously developed by the computer system based on one or more previous authentication codes successfully established as authentication codes to authenticate the user, wherein the authentication code preference model describes one or more user tendencies in creating the previous authentication codes; and determining, by the computer system based on the authentication code and the authentication code preference model, a value indicating a likelihood that the authentication code is created by the user rather than a third party impersonating the user, wherein the determining is based on a similarity between the one or more tendencies described by the authentication code preference model and the authentication code received by the computer system.