Windows has so many settings in local group policy editor for passwords, I’m sure there’s a way to detect failed attempts with a script in task scheduler and take a picture. I don’t know how myself but it’s probably possible. Idk about Mac. And for Linux, you can probably have it install a tracker on the thief’s phone over bluetooth…