Depending on the implementation, that's intentional if you fail the check for whatever reason. It doesn't return an error status or page to allow what it thinks is the automated attacker from trying another approach, it just loops you through the process indefinitely.