What does a failed login event prove?¶

A failed login event proves only that an authentication attempt was rejected or could not complete. Its failure code and processing stage determine what more can safely be inferred.

Failure does not always mean a wrong password¶

An account may be disabled, a token expired, multi-factor approval incomplete, a device blocked or an identity service unavailable. Stored old credentials, background services and security scanners can generate failures automatically, as can hostile password testing.

The account, application, source, authentication method, result code and sub-status can distinguish some of these causes. For example, a rejection before password validation cannot show that an entered password was wrong.

Patterns provide stronger context than one event¶

Preserve surrounding successes and failures, device details, source addresses and session or request identifiers. Repetition across accounts may support automated testing; repeated failures from one service may instead indicate a stale credential.

Even a technically clear rejection does not by itself establish who initiated it, their knowledge or their intent. Report the rejected method and reason first, then state any attribution as a separate inference supported by the wider evidence.