This is useful strategy in a "yes, and" capacity - take other action AND tarpit login attempts. In some situations, the requirement might be locking the abilit

This is useful strategy in a "yes, and" capacity - take other action AND tarpit login attempts. In some situations, the requirement might be locking the ability of an account to log in after X failed attempts over Y amount of time - say, 3 failed attempts in 5 minutes. Then it's necessary for the user to contact support/the sysadmin to unlock their account.