SELF-CHECK
Two failures precede one successful login. Is compromise proven?

REFERENCE REASONING
No. It is a signal to investigate with account-owner confirmation, device context and additional events. Preserve evidence and follow the organization’s incident process.

This is a reasoning reference for the supplied fictional case, not an executed app or tested cloud deployment. Alternative approaches are valid when supported by stated assumptions and evidence.
