Even better, let the login pass after some incorrect credential guesses, the login goes to a random fake account.