For security reasons, it might be better to have a less clear message like *Invalid credentials.*