Doesn't matter, they've already gotten your password at that point. They can just say "login failed" and redirect you to the real login page