In addition to the verification methods you've provided, Web services keep track of users using the following methods. Usually a failure in any of these services can cause a site to block access or lock an account.
These are text files that a website will send to your browser when you access a site or service. These files contain information specified by the site for use in things like authentication and recognition. Sometimes they store preferences, other times they may store things like last access time or last IP address. Often this information can be encrypted or encoded in a non-readable method. When a user visits a site, the information on the computer (if it exists) is compared with what they have on file.
Cookies are also useful in catching failed attempts. When a person (UserB) tries to login to a site as UserA the site can present them with a cookie for the username they're trying to use and another one containing the number of logins they've attempted. When they login as UserB and use their own account at a later time, the site can collect the cookies for the previous attempts and then cross-check their records to see if UserA is related to them or aware of the attempt.
When a user accesses a web server they open something called a session. During the session, the browser and the server exchange information in the form of variables and cookies. This information will exist as long as the session is open. Sessions can have a specific timeframe where they are active and they can also be destroyed when someone leaves a website or closes their browser. When a person tries to access a site from a second device using the same logins this will open a new session. Some websites are aware of this and will say something like "You're accessing your site from two locations. If you are NOT accessing this site from multiple locations please contact customer service."
Database Comparison (Location, Device, Activity, Habits)
Some web applications store information about a user, their habits in terms of spending (banks and credit card companies do this), frequency in access, and IP geolocation. When a user accesses a site their stored profile is compared with their current session to see if the user's behavior fits the pattern on record (Location, Device, Duration of access, Etc). An example might be someone logging in from another location where they have never logged in before.
Some sites like Google may require you to use an authentication app installed on a mobile device that you have been previously authenticated on or they may require you to check your e-mail account to get a one-time password. This is called two-step or two-stage authentication or verification. When you attempt to log into the site from a new machine or a machine that doesn't have an active session or existing cookie, you'll have to provide information from the second device (usually a cell phone or e-mail) to prove that you are the person who originally setup the account. Sometimes this is also done in the form of an SMS text message.
Timers and Real User Verification
Some sites will use a real user verification scheme like a CAPTCHA to make sure that a user is really a person and not a bot. Websites like banks and some stock photography sites implement other schemes to make sure you're not performing too many tasks at once when you have your session open. If you're reacting more quickly than a human user they may close your session. Additionally they may close your session due to inactivity because they try not to assume that a delay in access means the same user on the same terminal.
Preshared Key Verification
Most websites will provide a user with a password. The user is requested to provide this password when they access the site again.
Challenge and Response
Some sites request information in addition to a password in the form of a challenge and response phrase where a user can authenticate themselves. "Where do you go to School?" "Where were you born?" the answers to these sort of questions are typically not known outside of a user's circle of friends and family. The reason these questions aren't the main questions for authentication are because of things like unfiltered social media where someone can do a web search and find the answers by reading a profile.