User authentication such as password setting has become increasingly important for the secure management of the information stored in mobile devices. However, in the password authentication schemes used in mobile devices, enhancing security reduces their usability, and passwords become hard to memorize. In addition, enhancing their usability makes them vulnerable to shoulder-surfing or recording attacks involving stealing a glance at the authentication process through the system interface. In this paper, we propose a password authentication scheme that uses a virtual scroll wheel, called WheelLock, to ensure appropriate usability and prevent brute force, shoulder-surfing, and recording attacks.