Understood and I agree, but that's not the problem I'm trying to address. If the user needs to know what is going on and needs to reset a password, I want this

Understood and I agree, but that's not the problem I'm trying to address. If the user needs to know what is going on and needs to reset a password, I want this to be at the very latest possible time (like days or weeks into the problem).