Ok, use the classic "bad username or password".

Or just properly rate limit so hackers can't just slam the long in page with a zillion combos.